huntrule

Windows PowerShell: In-Memory Assembly Loading via Reflection.Assembly

Flags PowerShell script blocks that reference [Reflection.Assembly]::load for potential in-memory assembly loading.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_script
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-12-25
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags PowerShell script block content that includes the call pattern "[Reflection.Assembly]::load", which can be used to dynamically load assemblies in memory. Attackers may use in-memory loading to reduce disk artifacts and make execution harder to trace with traditional file-based monitoring. The detection relies on Script Block Logging telemetry capturing the executed script block text.

Reporting behind it

Related detections9 linkedT1620 — drag to rearrange
PowerShell Reflective Shellcode Loader via Dynamic API Delegates (via ps_script)
Obfuscated XE Group Reflective Loader via PowerShell Spawned by IIS Worker Process (via process_creation)
Suspicious Reflective Assembly Load in PowerShell (via ps_script)
Malicious VoidLink Fileless Execution via memfd via Memory (via process_creation)
Suspicious PowerShell Reflective Assembly Load Invoking VAI Method (via process_creation)
PowerShell In-Memory Shellcode Execution via Memory Allocation APIs (via ps_script)
Malicious Fileless Execution via memfd Anonymous File on Linux Cloud Workload (via process_creation)
Windows PowerShell: Base64 Encoded Reflective .NET Assembly Load
PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)
Windows PowerShell: In-Memory Assembly Loading via Reflection.Assembly
Pivot detection · T1620 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.