CustomLoadImage .NET Assembly Loading Technique

The CustomLoadImage technique allows threat actors to bypass traditional security measures when loading .NET assemblies. By directly invoking the AssemblyNative::LoadFromBuffer function, it circumvents hooks that security products often place on RuntimeAssembly.nLoadImage. This direct invocation provides a stealthier method for loading malicious .NET assemblies into memory. This technique is relevant because it allows attackers to evade common detection strategies and execute malicious .NET code without triggering alerts based on standard assembly loading procedures. The tool is available on GitHub at the provided URL.

Attack Chain

1. Attacker gains initial access to the target system (e.g., through phishing or exploiting a vulnerability).
2. Attacker deploys a custom loader, implementing the CustomLoadImage technique, onto the target system.
3. The custom loader uses AssemblyNative::LoadFromBuffer to load a malicious .NET assembly directly into memory.
4. This bypasses any hooks or checks that might be placed on RuntimeAssembly.nLoadImage.
5. The malicious .NET assembly executes its intended payload within the compromised process.
6. The payload may perform actions like credential theft, lateral movement, or data exfiltration.
7. The attacker maintains persistence, potentially by scheduling the malicious .NET assembly to reload using CustomLoadImage after system restarts.

Impact

Successful exploitation of the CustomLoadImage technique allows attackers to execute arbitrary .NET code on a compromised system while evading common security defenses. This can lead to a variety of malicious outcomes, including data theft, system compromise, and further propagation within the network. The stealthy nature of this technique makes it harder to detect and remediate, increasing the potential for significant damage.

Recommendation

• Monitor process memory for the execution of .NET assemblies loaded from unusual locations or without corresponding file paths; investigate any anomalies (Generic detection capability).
• Implement endpoint detection rules that flag processes calling AssemblyNative::LoadFromBuffer directly, especially when originating from non-standard or untrusted processes (see Sigma rule examples below).
• Inspect network traffic for unusual data patterns that may indicate exfiltration initiated by reflectively loaded assemblies.