PowerShell Reflective .NET Assembly Load via [Reflection.Assembly]::Load()

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•1

Detects the use of the [Reflection.Assembly]::Load method within PowerShell command lines. This method is often abused by attackers to reflectively load malicious .NET assemblies directly into memory, bypassing disk-based security controls.