PowerShell In-Memory Assembly Load via Reflection from Suspicious Sources

Jorden Smith@Jorden

•updated Feb 10, 2026•0•16

Detects PowerShell loading .NET assemblies into memory (not from disk) via reflection from suspicious sources including base64-encoded data, web downloads, or compressed streams. This pattern indicates fileless malware execution or post-exploitation tool delivery.