PowerShell spraying execution across multiple .NET LOLBins (fallback injection)
Detects instances where PowerShell rapidly cycles through a known list of Microsoft-signed .NET binary utilities (LOLBins) located in .NET framework directories, within a short duration. This behavior is consistent with resiliency-spray techniques, such as those used by Veil#Drop, to find an available binary to host an injected .NET assembly.
Microsoft Sentinel (KQL)
