Windows PowerShell: In-Memory Assembly Loading via [Reflection.Assembly]::load

Flags PowerShell script blocks that reference [Reflection.Assembly]::load for potential in-memory assembly loading.

FreeUnreviewedSigmamediumv1

windows-powershell-in-memory-assembly-loading-via-reflection-assembly-load-ddcd88cb

title: "Windows PowerShell: In-Memory Assembly Loading via [Reflection.Assembly]::load"
id: 33e74b87-0561-436e-afcc-b5486436f69e
status: test
description: This rule flags PowerShell script block content that includes calls to [Reflection.Assembly]::load, which can dynamically load assemblies directly into memory. Attackers may use this capability to execute or extend functionality while avoiding dropping new binaries to disk. The detection relies on Script Block Logging telemetry capturing the script text that contains the specified reflection-based load pattern.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file.yml
author: frack113, Huntrule Team
date: 2022-12-25
tags:
  - attack.stealth
  - attack.t1620
logsource:
  product: windows
  category: ps_script
  definition: Script Block Logging must be enable
detection:
  selection:
    ScriptBlockText|contains: "[Reflection.Assembly]::load"
  condition: selection
falsepositives:
  - Legitimate use of the library
level: medium
license: DRL-1.1
related:
  - id: ddcd88cb-7f62-4ce5-86f9-1704190feb0a
    type: derived

What it detects

This rule flags PowerShell script block content that includes calls to [Reflection.Assembly]::load, which can dynamically load assemblies directly into memory. Attackers may use this capability to execute or extend functionality while avoiding dropping new binaries to disk. The detection relies on Script Block Logging telemetry capturing the script text that contains the specified reflection-based load pattern.

Known false positives

Legitimate use of the library

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.