PowerShell decodes -EncodedCommand and reflectively loads a .NET assembly (Reflection.Assembly/Invoke/[type])
Detects the execution of PowerShell with encoded commands, specifically when initiated by a 'conhost.exe' process running with the '--headless' flag. The rule further inspects the decoded command to identify patterns indicative of .NET reflection-based code execution, often used in malicious activity such as reflective assembly loading.
Microsoft Sentinel (KQL)
