LokiBot Reflective .NET Assembly Load via PowerShell Script Block

Duo Tech@duotech

•updated Jun 30, 2026•0•0•0

Detects the use of reflective .NET assembly loading in PowerShell script blocks. This technique, commonly utilized by the LokiBot information stealer, allows attackers to load and execute malicious .NET payloads directly in memory, bypassing the need to write files to disk.