Reflective .NET Assembly Load via PowerShell [Reflection.Assembly]::Load

Duo Tech@duotech

•updated Jul 2, 2026•1•0•1

Detects the use of PowerShell commands that reflectively load .NET assemblies into memory using 'Reflection.Assembly::Load' or 'Assembly.Load'. This technique is frequently utilized by malicious scripts and fileless malware to execute code directly in memory, bypassing traditional disk-based detection mechanisms.