Assembly loading is the .NET runtime process of locating and bringing managed-code libraries, called assemblies, into an application so their code can be used. The runtime may resolve assemblies from application directories, configured locations, or other specified sources.
Because loading determines which code runs, attackers may manipulate configuration or execution flow to make a legitimate .NET process load an unintended assembly. Techniques such as AppDomainManager injection can influence this behavior without necessarily exploiting a software vulnerability. Defenders can look for unexpected .NET configuration changes, unfamiliar assemblies, unusual file locations, and loading activity that does not fit a process’s normal behavior; digital signatures alone do not establish that a file is being used safely.