PowerShell Base64 Encoded Reflective Assembly Load

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•35

Detects PowerShell commands attempting to load .NET assemblies reflectively using Base64 encoded strings. This technique is often used by adversaries to execute malicious code in memory, evading disk-based detections.