ПостNew blog on using CLR customizations to improve the OPSEC of your .NET execution harness. This includes a novel AMSI byp…

New blog on using CLR customizations to improve the OPSEC of your .NET execution harness. This includes a novel AMSI bypass that identified by author in 2023. By taking control of CLR assembly loads, we can load assemblies from memory with no AMSI scan. Proof-of-concept for the AMSI bypass and an implementation of a CLR memory manager is on GitHub. We can implement custom memory routines and track all allocations made by the CLR. https://github.com/passthehashbrowns/Being-A-Good-CLR-Host Related Works and Resources HostingCLR - Original implementation of CLR hosting InlineExecute-Assembly - Original implementation of executing .NET assemblies as a BOF Dealing with Failure: Failure Escalation Policy in CLR Hosts – This is the only real example I could find of offensive tradecraft using CLR Customizations when I was initially doing this research. Hosted Pumpkin – A GitHub repository containing a proof-of-concept for implementing several CLR Customizations. Shellcode: Loading .NET Assemblies From Memory – Donut was a great deal of help in wrangling all of the relevant data structures and definitions in C. Customizing the Microsoft .NET Framework Common Language Runtime by Steven Pratschner – This is the definitive text on CLR Customizations. Simply a must-read if you have any interest in this area. #redteam #net #clr #dotnet