Suspicious CLR Logs Creation

Detects suspicious .NET assembly executions. Could detect using Cobalt Strike's command execute-assembly.