# Decompile with ILSpy CLI
ilspycmd ./target.dll -o ./decompiled/

# Inspect assembly metadata
monodis --typedef ./target.dll
monodis --method ./target.dll

# Deobfuscate .NET
de4dot ./target.exe -o ./cleaned.exe

# Extract embedded resources
python3 -c "
import dnfile
pe = dnfile.dnPE('./target.dll')
for r in pe.net.resources:
    print(f'{r.name}: {r.size} bytes')
"

# Identify target and gather initial intelligence
file ./target_sample
dnspy --version 2>/dev/null || echo "Install dnSpy"

# Set up working directory
mkdir -p /tmp/analyzing-dotnet-assemblies/{output,logs,artifacts}

# Execute primary analysis with dnSpy
# Refer to Quick Reference above for detailed commands
echo "[*] Running Analyzing Dotnet Assemblies with dnSpy..."

# Log all operations
script -q /tmp/analyzing-dotnet-assemblies/logs/session.log

# Apply ILSpy for secondary analysis
echo "[*] Deep investigation with ILSpy..."

# Cross-reference findings
diff /tmp/analyzing-dotnet-assemblies/output/primary.json /tmp/analyzing-dotnet-assemblies/output/secondary.json

# Generate structured findings report
cat <<'EOF' > /tmp/analyzing-dotnet-assemblies/output/report.json
{
  "technique": "analyzing-dotnet-assemblies",
  "domain": "reverse-engineering",
  "tools_used": ["dnSpy", "ILSpy"],
  "findings": [],
  "recommendations": []
}
EOF

title: Dotnet Assemblies Detection
id: df17ae97-986d-41f9-96af-ac65538ebd02
status: experimental
description: Detects suspicious activity related to analyzing dotnet assemblies techniques in reverse engineering context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*dotnet*"
  condition: selection
level: medium
tags:
  - attack.t1027
  - attack.t1059.001
  - attack.defense_evasion
falsepositives:
  - Malware analysis sandbox performing automated binary inspection