PowerShell Reflective .NET Assembly Load via Reflection.Assembly::Load()

Ibrahim Saud@tektrix

•updated 27 days ago•0•0•2

Detects long PowerShell command lines that perform in-memory assembly loading, often utilizing compression (GzipStream), encryption (Aes), or base64 decoding (FromBase64String). This combination is highly indicative of malicious payloads attempting to load reflective DLLs or executables directly into memory to evade file-based detection.