PowerShell fallback reflective invocation via RegSvcs/InstallUtil/MSBuild binaries

Duo Tech@duotech

•updated Jul 6, 2026•4•0•2

Detects PowerShell execution involving reflection patterns (GetMethod('C') and Invoke) combined with the execution or targeting of known Living-off-the-Land binaries (LOLBins). This pattern is often used to execute malicious payloads in-memory, bypassing traditional signature-based detection.