Fileless PowerShell In-Memory DLL Loading via Reflection.Assembly

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•4

Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.