In-Memory PE Loading Without Disk Write

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects potential in-memory PE loading without disk write by looking for specific strings in HTTP file data. It specifically searches for the strings "Assembly.Load(" and "Invoke(" (case-insensitive) within the HTTP response body (flow:to_client,established; file.data). This combination of strings is indicative of .NET applications dynamically loading assemblies into memory and then executing methods, which can be a technique used by malware to avoid writing executables to disk.