Reflection

Adversaries leverage .NET reflection within PowerShell to reflectively load and execute compiled .NET assemblies directly from memory without writing binaries to disk. By passing raw assembly bytes (such as from a Base64-encoded string) to [System.Reflection.Assembly]::Load(), operators inspect loaded types and invoke entry points or specific methods reflectively, bypassing traditional disk-based antivirus inspection and file monitoring controls.