Reflective .NET Assembly Load from AES/GZip Decrypted In-Memory Payload

Duo Tech@duotech

•updated Jul 21, 2026•3•1•13

Detects the use of PowerShell to perform reflective assembly loading of a payload that has been decrypted using AES and decompressed with GZip. This pattern is commonly used by attackers to load malicious .NET assemblies directly into memory while bypassing static file-based detection.