TGViewer
Sec Note Sec Note @secnote · 2.89K subscribers
Post #29 704
New blog on using CLR customizations to improve the OPSEC of your .NET execution harness. This includes a novel AMSI bypass that identified by author in 2023. By taking control of CLR assembly loads, we can load assemblies from memory with no AMSI scan.


Proof-of-concept for the AMSI bypass and an implementation of a CLR memory manager is on GitHub. We can implement custom memory routines and track all allocations made by the CLR.

https://github.com/passthehashbrowns/Being-A-Good-CLR-Host



Related Works and Resources
HostingCLR - Original implementation of CLR hosting

InlineExecute-Assembly - Original implementation of executing .NET assemblies as a BOF

Dealing with Failure: Failure Escalation Policy in CLR Hosts – This is the only real example I could find of offensive tradecraft using CLR Customizations when I was initially doing this research.

Hosted Pumpkin – A GitHub repository containing a proof-of-concept for implementing several CLR Customizations.

Shellcode: Loading .NET Assemblies From Memory – Donut was a great deal of help in wrangling all of the relevant data structures and definitions in C.

Customizing the Microsoft .NET Framework Common Language Runtime by Steven Pratschner – This is the definitive text on CLR Customizations. Simply a must-read if you have any interest in this area.





#redteam #net #clr #dotnet
  • 👾 2
More from @secnote
  1. Sep 27, 2026EDR Evasion: Process Injection Without WriteProcessMemory #EDR #maldev
  2. Sep 25, 2026سلام و درود لنگ ظهر جمعه تون بخیر فایل 4 دوره #SEC530 خدمت شما. واقعا طولانی شد 😅
  3. Sep 24, 2026Sec Note pinned a photo
  4. Sep 24, 2026My New Blog Post Evading Sysmon Dns Monitoring In 2026 | binary-win DNSevade : https://git…
  5. Sep 23, 2026Did Sysmon miss the DNS event?👀
  6. Sep 22, 2026fbi job portal defaced and compromised? oh yeah, it's a silly tuesday
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →