.NET Loader - Reflective Assembly Load via PowerShell (T1055)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load, explicitly bypassing disk IO to execute the compiled ClassLibrary stage.