PowerShell Compressed Base64 Payload with Assembly Load

Jorden Smith@Jorden

•updated Feb 10, 2026•4•0•27

Detects PowerShell scripts that perform a multi-stage obfuscation pattern involving the decompression of data using 'IO.Compression.DeflateStream' or 'IO.Compression.GzipStream', followed by base64 decoding using 'FromBase64String' or 'Convert::FromBase64', and finally loading the resulting payload as a .NET assembly using 'Reflection.Assembly' or 'Assembly]::Load'. This combination of actions is indicative of malware delivery techniques.