Title:Potential In-Memory Execution Using Reflection.Assembly Status:test Description:Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory References: -https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50 Author: frack113 Date: 2022-12-25 modified:None Tags:
-'attack.stealth'
-'attack.t1620'
Logsource:
product: windows
category: ps_script
definition: Script Block Logging must be enable
Detection: selection: ScriptBlockText|contains:
'[Reflection.Assembly]::load' condition:selection Falsepositives:
-Legitimate use of the library Level:medium
