attack.t1620 | Detection.FYI

Potential In-Memory Execution Using Reflection.Assembly

Aug 12, 2024 · attack.defense-evasion attack.t1620 ·
Share on:

Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory

Read More
PowerShell Base64 Encoded Reflective Assembly Load

Aug 12, 2024 · attack.execution attack.t1059.001 attack.defense-evasion attack.t1027 attack.t1620 ·
Share on:

Detects base64 encoded .NET reflective loading of Assembly

Read More
Gootloader Stage 2 Registry Key Creation

Nov 9, 2022 · attack.execution attack.defense_evasion attack.t1620 ·
Share on:

Detects potential stage 2 Gootloader registry key creation.

Read More