Detect assembly loading via nLoadImage (#1172)

* Initial support for nLoadImage Signed-off-by: Still Hsu <[email protected]> * Merge 'invoke .NET assembly method' rule match into condition Signed-off-by: Still Hsu <[email protected]> * Update dynamic scope per requested changes https://github.com/mandiant/capa-rules/pull/1172#discussion_r3647155878 Signed-off-by: Still Hsu <[email protected]> --------- Signed-off-by: Still Hsu <[email protected]>
2026-10-11 21:39:59 +00:00 · 2026-07-28 10:59:09 -06:00
parent 48c6cd1b11
commit 67f626eecb
2 changed files with 21 additions and 1 deletions
@@ -0,0 +1,20 @@
+rule:
+  meta:
+    name: load .NET assembly via RuntimeAssembly.nLoadImage
+    namespace: load-code/dotnet
+    authors:
+      - [email protected]
+    scopes:
+      static: file
+      dynamic: span of calls
+    att&ck:
+      - Defense Evasion::Reflective Code Loading [T1620]
+    references:
+      - https://dr4k0nia.github.io/posts/NixImports-a-NET-loader-using-HInvoke/
+    examples:
+      - 6c8b0f234a239eb76c80b6e5b911720dfcd3738ff410375fbc65030c1f8fefe1
+  features:
+    - and:
+      - format: dotnet
+      - string: "nLoadImage"
+      - match: invoke .NET assembly method
@@ -7,7 +7,7 @@ rule:
      - [email protected]
    scopes:
      static: function
-      dynamic: call
+      dynamic: span of calls
    att&ck:
      - Defense Evasion::Reflective Code Loading [T1620]
  features: