How does the `.NET_oneliner` payload load assemblies from memory in Pupy?
The `.NET_oneliner` payload generates a PowerShell command that uses `[Reflection.Assembly]::Load()` to download and execute a .NET assembly directly from memory. For example: `powershell -w hidden -enc "xxxxxxxxxxxxxx"`. This approach avoids writing the assembly to disk and leverages PowerShell's ability to load .NET objects. The underlying technique is further analyzed in the article Analysis of Exploiting .NET Assembly Loading from Memory (Assembly.Load) — note that the provided content references a previous article on this topic, but you can also refer to the main Pupy feature article for context.
.NET_onelinerPowerShellAssembly.Loadmemory loading.NETPupy