PowerShell Reflective .NET Assembly Load via Assembly.Load/EntryPoint.Invoke

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•3

Detects the use of .NET reflection methods such as Assembly.Load or EntryPoint.Invoke within PowerShell command lines. This behavior is frequently used by attackers to reflectively load malicious .NET assemblies or shellcode directly into process memory, bypassing disk-based detection.