How does Casey Smith's bypass method differ from bohops' method?
Casey Smith's method reads the assembly as bytes using `[System.IO.File]::ReadAllBytes()` and then loads it via `[Reflection.Assembly]::Load($bytes)`. This avoids the need for the diagnostic script, but the underlying mechanism is the same: using `Assembly.Load` instead of `Assembly.LoadFile`. The article demonstrates both methods are functionally equivalent and can be simplified to a single `[Reflection.Assembly]::LoadFile()` call. Both techniques are only effective with assemblies compiled for .NET 2.0.
AppLocker bypassAssembly.LoadCasey SmithPowerShell.NET 2.0