PowerShell reflective .NET assembly load into memory (Stella_Gary)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•2•0•5

Detects the use of PowerShell to reflectively load .NET assemblies into memory, often associated with fileless malware execution. The rule monitors for common reflection-based methods (e.g., Assembly.Load, [System.Reflection.Assembly]) in conjunction with encoded command patterns or script execution.