PowerShell Reflective Assembly Load in Memory

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to load a PowerShell assembly reflectively in memory. It specifically looks for the string "[System.Reflection.Assembly]::Load(" within HTTP response data flowing to a client. This technique is often used by malware to execute malicious code without writing it to disk, making it a common defense evasion tactic.