Windows PowerShell In-Memory Assembly Loading via Reflection.Assembly::Load

Flags PowerShell script blocks that reference [Reflection.Assembly]::load for potential in-memory assembly loading.

FreeReviewedSigma · Medium · v5

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-12-25
Updated: 2026-10-21

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1620Reflective Code Loading
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script block content that contains the pattern "[Reflection.Assembly]::load", indicating an attempt to dynamically load an assembly from memory using .NET reflection. Attackers can use this technique to execute code in a stealthier way than dropping binaries to disk. The detection relies on Script Block Logging telemetry that records the PowerShell script block text.

Reporting behind it

Related detections9 linkedT1620 — drag to rearrange

Malicious Reflective Assembly Loading via PowerShell (via ps_script)

Suspicious PowerShell Reflective Assembly Load With Registry Property Read via Script Block (via ps_script)

Suspicious In-Memory .NET Assembly Load via PowerShell Base64 Payload (via process_creation)

Suspicious Fileless Execution From Memory File Descriptor via PUMAKIT

Suspicious DllHost Spawned By MMC Without Arguments via PASTALOADER

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

PowerShell Reflective Shellcode Loader via Dynamic API Delegates (via ps_script)

Obfuscated XE Group Reflective Loader via PowerShell Spawned by IIS Worker Process (via process_creation)

Suspicious Reflective Assembly Load in PowerShell (via ps_script)

Windows PowerShell In-Memory Assembly Loading via Reflection.Assembly::Load

Pivot detection · T1620 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-10-21
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-in-memory-assembly-loading-via-reflection-assembly-load-ddcd88cb

title: Windows PowerShell In-Memory Assembly Loading via Reflection.Assembly::Load
id: 33e74b87-0561-436e-afcc-b5486436f69e
status: test
description: This rule flags PowerShell script block content that contains the pattern "[Reflection.Assembly]::load", indicating an attempt to dynamically load an assembly from memory using .NET reflection. Attackers can use this technique to execute code in a stealthier way than dropping binaries to disk. The detection relies on Script Block Logging telemetry that records the PowerShell script block text.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file.yml
author: frack113, Huntrule Team
date: 2022-12-25
modified: 2026-10-19
tags:
  - attack.stealth
  - attack.t1620
logsource:
  product: windows
  category: ps_script
  definition: Script Block Logging must be enable
detection:
  selection:
    ScriptBlockText|contains: "[Reflection.Assembly]::load"
  filter_optional_sqlserver:
    Path|startswith:
      - C:\Program Files (x86)\Microsoft SQL Server\
      - C:\Program Files\Microsoft SQL Server\
    Path|endswith: \Tools\PowerShell\Modules\SQLPS\SqlPsPostScript.ps1
    ScriptBlockText|contains: "SQLSERVER: { Set-Location"
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate use of the library
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file/info.yml
license: DRL-1.1
related:
  - id: ddcd88cb-7f62-4ce5-86f9-1704190feb0a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL