PowerShell In-Memory .NET Assembly Load via Reflection (Veil#Drop)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects the use of .NET reflection APIs (specifically System.Reflection.Assembly::Load) within PowerShell script blocks. This technique allows for the dynamic loading of .NET assemblies into memory, often to execute obfuscated or encrypted payloads without writing them to disk, which is a common tactic for bypassing file-based security controls.