load .NET assembly via RuntimeAssembly.nLoadImage

rule:
  meta:
    name: load .NET assembly via RuntimeAssembly.nLoadImage
    namespace: load-code/dotnet
    authors:
      - still@teamt5.org
    scopes:
      static: file
      dynamic: span of calls
    att&ck:
      - Defense Evasion::Reflective Code Loading [T1620]
    references:
      - https://dr4k0nia.github.io/posts/NixImports-a-NET-loader-using-HInvoke/
    examples:
      - 6c8b0f234a239eb76c80b6e5b911720dfcd3738ff410375fbc65030c1f8fefe1
  features:
    - and:
      - format: dotnet
      - string: "nLoadImage"
      - match: invoke .NET assembly method