APT36 Fileless PowerShell Assembly Load Technique

Georg Lauenstein@gsec

•updated Mar 16, 2026•6•0•124

Detects PowerShell reflective assembly loading with byte array reversal technique used by APT36 SheetCreep