AssemblyHunter
A Windows tool for red-team engagements that searches a host's filesystem, services and scheduled tasks for .NET assemblies that could serve as payloads or be used in post-exploitation.
AssemblyHunter was released alongside a conference talk on abusing ClickOnce for trusted code execution, and is built to locate .NET assemblies on a compromised or target host that could be repurposed for a payload or for post-exploitation. It can search a given path, check a single file or a list of files, or scan Windows services and scheduled tasks for assemblies used in their binary paths or actions.
Options narrow the search to executables only, signed assemblies only (printing certificate issuer and subject), assemblies deployable through ClickOnce, or Electron applications instead of .NET assemblies, and can report an assembly's architecture, UAC settings, references and manifest identity.
It targets .NET Framework 4.0 and newer, is written in C#, and is licensed under BSD-3-Clause; no prebuilt binaries are provided.