Suspicious Encoded and Obfuscated .NET Reflection Assembly Load

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" within process command lines. This technique is often used by malware to dynamically load assemblies, evading static analysis.