{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/in-memory/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["windows","powershell","stealth","in-memory"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe use of .NET reflection via PowerShell enables attackers to load .NET assemblies directly from memory, effectively executing malicious binaries without writing them to disk. This technique leverages the \u003ccode\u003e[Reflection.Assembly]::Load\u003c/code\u003e or \u003ccode\u003e[Reflection.Assembly]::LoadFrom\u003c/code\u003e methods to bypass traditional file-based detection mechanisms and endpoint security products that monitor file system changes. By executing code entirely in the memory space of a PowerShell process, adversaries can maintain stealth and reduce their forensic footprint on the host. This behavior is commonly observed during the post-exploitation phase, where attackers load secondary payloads, custom tools, or offensive frameworks. Defenders must monitor PowerShell Script Block Logging to capture the execution of these reflection methods, as they are not visible via standard file-creation events.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial execution on a target system, often via a spearphishing attachment or exploited web vulnerability.\u003c/li\u003e\n\u003cli\u003eThe attacker launches a PowerShell process to execute commands within the victim's environment.\u003c/li\u003e\n\u003cli\u003eThe attacker fetches a malicious .NET assembly (e.g., a DLL or EXE) from a remote URL or reads it from a hidden encoded string in the initial script.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the \u003ccode\u003e[System.Reflection.Assembly]::Load()\u003c/code\u003e method within a PowerShell script block to load the binary into the active process's memory.\u003c/li\u003e\n\u003cli\u003eOnce loaded, the attacker calls methods or classes from the malicious assembly to execute its payload.\u003c/li\u003e\n\u003cli\u003eThe malicious payload performs its objective, such as credential theft, lateral movement, or data exfiltration.\u003c/li\u003e\n\u003cli\u003eThe process terminates or continues to reside in memory, leaving minimal evidence on the disk.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for fileless execution of arbitrary code, significantly complicating incident response and forensic analysis. This technique is often used to launch offensive tooling, such as Cobalt Strike beacons or custom post-exploitation kits, which can lead to full environment compromise and sensitive data exfiltration if not detected and blocked.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the implementation of robust monitoring for PowerShell activity across all enterprise endpoints to detect suspicious reflection-based execution.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to capture the full command structure, including reflection methods.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to identify script blocks utilizing \u003ccode\u003e[Reflection.Assembly]::load\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReview any identified PowerShell execution for context, as administrative scripts may utilize these methods for legitimate software deployment or system management.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-03T13:38:14Z","date_published":"2026-09-03T13:38:14Z","id":"https://feed.craftedsignal.io/briefs/2026-09-in-memory-assembly-loading/","summary":"This brief documents the use of .NET reflection techniques within PowerShell to execute arbitrary code in-memory, a method frequently utilized to bypass file-based security controls.","title":"Detection of In-Memory Assembly Loading via PowerShell Reflection","url":"https://feed.craftedsignal.io/briefs/2026-09-in-memory-assembly-loading/"}],"language":"en","title":"CraftedSignal Threat Feed - In-Memory","version":"https://jsonfeed.org/version/1.1"}