Skip to content
Threat Feed

Tag

Psreflect

1 brief RSS
high advisory

PowerShell PSReflect Script Detection

This rule detects PowerShell script block content containing PSReflect-style helper indicators, such as Add-Win32Type, New-InMemoryModule, or DllImport patterns, that may support dynamic Win32 API invocation from PowerShell.

powershell psreflect windows execution
2r 1t