Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call

About the rule

Rule Type

Standard

Rule Description

This rule looks for suspicious Base64-encoded and obfuscated LOAD keywords embedded in .NET reflection.assembly calls. Attackers use this technique to perform in-memory execution of malicious .NET payloads without writing files to disk. By leveraging obfuscation and encoded commands, they can evade traditional signature-based security tools and execute code stealthily in RAM.

Severity

Trouble

Rule journey

Attack chain scenario

Compromised web server → Weaponized .NET loader uploaded → Encoded PowerShell runs loader in memory → Obfuscated reflection LOAD used → Payload executes fully in RAM

Impact

• Memory-resident malware execution
• Full system compromise
• Data breach

Rule Requirement

Prerequisites

Process Creation Auditing

Via Windows Event Viewer (GPO)

1. Open GPMC (gpmc.msc) using a domain admin account.
2. Navigate to:
   Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking
3. Enable:
   • Audit Process Creation
   • Audit Process Termination
     (Check “Success” box for both)
4. For command-line logging:
   Go to:
   Computer Configuration > Administrative Templates > System > Audit Process Creation
   → Enable “Include command line in process creation events.”
5. Create registry key (if missing):
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Security-Auditing/Operational

Using Sysmon

To set up process creation monitoring with Sysmon:

1.Download and install Sysmon from Microsoft Sysinternals.

2. Open a Command Prompt with administrator privileges.

3. Create or download a Sysmon configuration file that includes process creation monitoring. A basic example for capturing all process creations is:

<Sysmon>
<EventFiltering>
<ProcessCreate onmatch="exclude"/>
</EventFiltering>
</Sysmon>

4. Install Sysmon with your configuration file using the command:

sysmon.exe -i [configfile.xml] (Replace [configfile.xml] with your file's path and name).

5. Ensure a new registry key named "Microsoft-Windows-Sysmon/Operational" exists in the directory Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\. If not, create it.

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

Defense Evasion: Obfuscated Files or Information (T1027), Execution: Command and Scripting Interpreter - PowerShell (T1059.001)

Security Standards

Enabling this rule will help you meet the security standard's requirement listed below:

NIST CSF DE.CM-1: Network and physical activities are monitored to detect anomalous events.

When this rule is triggered, you're notified of Base64-encoded and obfuscated LOAD keywords within PowerShell command lines, which are strong indicators of reflective .NET assembly loading. This enables you to restrict execution policies and allow only signed scripts.

Author

pH-T (Nextron Systems)

Future actions

Known False Positives

Internal red team exercises using encoded reflection assembly loads may also trigger this rule.

Next Steps

When this rule is triggered, the following measures can be implemented:

1. Identification: Identify if the flagged event is a new incident or part of an existing incident.
2. Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
3. Response: Respond promptly by initiating an automated workflow to interrupt the network connections and cease the malicious process.
4. Audit PowerShell activities: Enable PowerShell Script Block Logging to capture all executed code blocks.

Mitigation