Windows PowerShell: In-Memory Assembly Loading via Reflection.Assembly
Flags PowerShell script blocks that reference [Reflection.Assembly]::load for potential in-memory assembly loading.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-12-25
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block content that includes the call pattern "[Reflection.Assembly]::load", which can be used to dynamically load assemblies in memory. Attackers may use in-memory loading to reduce disk artifacts and make execution harder to trace with traditional file-based monitoring. The detection relies on Script Block Logging telemetry capturing the executed script block text.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell: In-Memory Assembly Loading via Reflection.Assembly"
id: 33e74b87-0561-436e-afcc-b5486436f69e
status: test
description: This rule flags PowerShell script block content that includes the call pattern "[Reflection.Assembly]::load", which can be used to dynamically load assemblies in memory. Attackers may use in-memory loading to reduce disk artifacts and make execution harder to trace with traditional file-based monitoring. The detection relies on Script Block Logging telemetry capturing the executed script block text.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file.yml
author: frack113, Huntrule Team
date: 2022-12-25
tags:
- attack.stealth
- attack.t1620
logsource:
product: windows
category: ps_script
definition: Script Block Logging must be enable
detection:
selection:
ScriptBlockText|contains: "[Reflection.Assembly]::load"
condition: selection
falsepositives:
- Legitimate use of the library
level: medium
license: DRL-1.1
related:
- id: ddcd88cb-7f62-4ce5-86f9-1704190feb0a
type: derived