ROOTBOY PowerShell .NET Reflection Load Extension.SubRoutine.Run2 to hellolargeworld.com

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects execution of PowerShell commands that reflectively load a .NET assembly into memory using System.Reflection.Assembly::Load. The rule specifically flags behavior associated with the 'ROOTBOY' implant, which involves invoking the 'Extension.SubRoutine' class method 'Run2' and communicating with the C2 domain 'hellolargeworld.com'.