PowerShell Reflective .NET Assembly Load via ClickFix StealC Loader
Detects PowerShell processes executing [Reflection.Assembly]::Load to load .NET assemblies directly into memory. This behavior is commonly used by fileless loaders such as StealC to execute malicious payloads while avoiding disk-based artifacts.
YARA-L
