Codex - Reflective PE Assembly Loading (T1620)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Identifies the final stage of Codex where the decrypted byte array is reflectively loaded into the .NET runtime using [System.Reflection.Assembly]::Load and subsequently invoked via EntryPoint.Invoke. This rule specifically looks for PowerShell command executions containing these reflective loading patterns.