Reflective .NET Assembly Load via PowerShell

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•16

Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a suspicious C2 domain (hellolargeworld.com) or invocation method (Extension.SubRoutine.Run2).