PowerShell Reflective .NET Assembly Load with StealC AES Key/IV

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects malicious PowerShell scripts that perform reflective loading of .NET DLLs into memory. The rule identifies patterns associated with the 'ClickFix' or 'StealC' loaders, specifically looking for combinations of Assembly.Load, GZip decompression, and hardcoded AES encryption keys/IVs frequently used by these campaigns.