A .NET assembly is a managed code package that the .NET runtime can load and execute. It usually contains intermediate language (IL) code, metadata, and references to other components, and it is typically delivered as a DLL or EXE. The runtime uses the metadata to resolve types, methods, and dependencies before running the code.
Assemblies matter in security because attackers can use them as a compact payload format and, in some workflows, load them directly from memory instead of writing them to disk. That reduces the value of file-based detection and can make analysis harder. In real attacks, an assembly may be staged by a script or PowerShell command and then executed through reflection or a memory loader. Defenders look for unusual process chains, in-memory module loading, CLR activity, and suspicious script behavior. Logging, application control, and AMSI or EDR telemetry can help expose assemblies that never appear as normal files.