Dotnet on Matt Swann — Detection Engineering & Threat Intel

Dotnet on Matt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/tags/dotnet/Recent content in Dotnet on Matt Swann — Detection Engineering & Threat IntelMatt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/og-image.pnghttp://mattswann.dev/og-image.pngHugoen-usThu, 12 Feb 2026 23:26:36 -0700AppDomainManager Injection — Bend .NET Assemblies to Your Willhttp://mattswann.dev/posts/appdomainmanager-injection/Thu, 12 Feb 2026 23:26:36 -0700http://mattswann.dev/posts/appdomainmanager-injection/A deep dive into AppDomainManager injection (T1574.014): how attackers use .NET’s own extensibility model to proxy execution of malicious assemblies through legitimate signed binaries, and what defenders can — and can’t — do about it.