PowerShell Loading In Memory Dotnet Assembly

Tim Peck@timpeck

•updated Jan 15, 2026•8•0•73

Detects a PowerShell process that makes an outbound network connection and contains command-line arguments associated with reflectively loading a .NET assembly from a Base64 encoded string. This is a common fileless technique used by malware like Remcos to execute payloads in memory.