PowerShell RegSvcs.exe Reflection Fallback for In-Memory Payload
Detects the execution of regsvcs.exe when initiated by PowerShell, or when invoked with specific command line arguments indicating .NET reflection (GetType, GetMethod, method.Invoke) typically associated with fileless execution or proxying malicious code. The rule specifically targets instances involving .NET Framework directories.
Microsoft Sentinel (KQL)
