PowerShell XOR Decrypt and Reflective .NET Load - Pussecretvk456 Key

Duo Tech@duotech

•updated Jun 30, 2026•0•0•1

This rule detects PowerShell commands that perform XOR decryption of an embedded payload using the hardcoded key 'Pussecretvk456' and subsequently use [System.Reflection.Assembly]::Load to reflectively load the resulting .NET assembly into memory. This behavior is indicative of fileless execution patterns commonly observed in the LokiBot and Amadey malware families.