PowerShell Reflective .NET Assembly Load (Veil#Drop In-Memory Execution)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

Detects the use of PowerShell commands that leverage Reflection.Assembly.Load, a common technique for loading .NET assemblies directly into memory. This behavior is often associated with fileless malware, reflective DLL injection, or obfuscated payloads attempting to bypass security controls like AMSI.