windows enabled community high v1.0.0

cl-loadassembly

PowerShell Diagnostic Script Located at: C:\Windows\diagnostics\system\Audio\CL_LoadAssembly.ps1.

📋 Live Preview 
cl-loadassembly
cl-loadassembly

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Proxy execute Managed DLL with PowerShell (Execute proxied payload with Microsoft signed binary)

powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/ff6c54ded6b52f379cec11fe17c1ccb956faa660/rules/windows/process_creation/proc_creation_win_lolbas_cl_loadassembly.yml

Documentation

cl-loadassembly

cl-loadassembly is a Windows LOLBin. PowerShell Diagnostic Script Located at: C:\Windows\diagnostics\system\Audio\CL_LoadAssembly.ps1.

References