Fileless C# Compilation of Downloaded Payload via PowerShell Add-Type
Detects PowerShell or pwsh processes that download remote content and subsequently compile it in-memory using Add-Type, a fileless execution technique observed in the SMOKE#SCREEN campaign to load .NET loaders without writing an executable to disk.
Cortex XDR
