Potential In-Memory Execution Using Reflection.Assembly — Detection Rule
Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory
Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory