Reflective In-Memory Module Load Following mshta/PowerShell ClickFix Chain

Arnold Chan@slaz

•updated Sep 5, 2026•1•0•2

This rule detects potential reflective code injection or in-memory loading (fileless) where a DLL or PE image is loaded by mshta.exe or powershell.exe, but the module load event lacks a valid file path on disk (or indicates a device path). This behavior is often associated with the execution of malicious payloads such as the Amatera loader, where payloads are executed directly in memory to evade file-based security detections.