PowerShell In-Memory .NET Assembly Load

Ethan Andrews@eandrews

•updated Feb 23, 2026•4•1•52

Detects PowerShell commands that attempt to load a .NET assembly directly into memory using reflection. This is common in fileless malware delivery, such as the Remcos RAT campaign described in the provided intel, which uses reflection to load the final RAT stage from a steganographic JPEG, making disk-based detection ineffective.