Elastic Security Detection Rules

Suspicious .NET Reflection via PowerShell

Last updated a month ago on 2026-02-09
Created 4 years ago on 2021-10-15

About

Detects PowerShell scripts that invoke Reflection.Assembly or Assembly.Load to load .NET assemblies. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions.
Tags
Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: Defense EvasionTactic: ExecutionData Source: PowerShell LogsLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Process Injection (T1055)(external, opens in a new tab or window)

↳ Reflective Code Loading (T1620)(external, opens in a new tab or window)

Execution (TA0002)(external, opens in a new tab or window)

↳ Command and Scripting Interpreter (T1059)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
winlogbeat-*logs-windows.powershell*
Related Integrations

windows(external, opens in a new tab or window)

Query
text code block:
event.category:process and host.os.type:windows and
(
  powershell.file.script_block_text : (
    "[System.Reflection.Assembly]::Load" or
    "[Reflection.Assembly]::Load" or
    "Assembly.Load("
  ) and
  powershell.file.script_block_text : (
      "FromBase64String" or "GzipStream" or "DeflateStream" or "IO.Compression" or
      "MemoryStream" or "DownloadData" or "WebClient" or "ReadAllBytes"
  )
)

Install detection rules in Elastic Security

Detect Suspicious .NET Reflection via PowerShell in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).