> Technique · Reflective Assembly Delegate Execution_

~/packetpursuit $ cat /intel/techniques/reflective-assembly-delegate-execution.md

typetechniqueconfidencehighcreated2026-07-01updated2026-07-01executionreflective-loadingdotnetdelegatein-memorycode-injection

Reflective Assembly Delegate Execution

Description

A .NET execution technique in which a byte array (decrypted from a resource, overlay, or network stream) is loaded into memory via Assembly.Load(byte[]) and then invoked through MethodBase.Invoke, Delegate.CreateDelegate, or DynamicMethod + ILGenerator. The payload never touches disk, leaving no file artifacts for forensic recovery.

Mechanism

  1. Staging: The outer binary decrypts the inner payload (AES, XOR, GZip, Base64, or raw)
  2. Loading: Assembly.Load(decryptedBytes) returns an Assembly object
  3. Resolution: assembly.GetType("Namespace.Class").GetMethod("Entry") resolves the entry point
  4. Invocation: method.Invoke(null, args) or Delegate.CreateDelegate(...).DynamicInvoke(...) transfers control

Variants

  • Simple reflection: Direct Assembly.Load -> MethodBase.Invoke
  • Delegate thunk: DynamicMethod + ILGenerator + GetDelegateForFunctionPointer for native bridging
  • P/Invoke bridge: Marshal.GetDelegateForFunctionPointer to call unmanaged shellcode after VirtualProtect

Notable Examples

  • 931242f8... — Unobfuscated .NET 4.8 loader using Assembly, ExecuteMethod, GetMethod, Invoke, Marshal, IntPtr, and VirtualProtect to bridge decrypted overlay into execution. ^[sample 931242f8/strings.txt]
  • 07835853... — ConfuserEx-obfuscated variant using DynamicMethod + ILGenerator thunks. ^[sample 07835853/strings.txt]

Detection

  • ETW events for Assembly.Load from a byte array (Event ID 154 in .NET runtime)
  • Memory-only modules with no corresponding disk file (scanners like Hunt-Sleeping-Beacons or ETW "Image Load" events without a file path)
  • Suspicious DynamicMethod creation with ILGenerator emitting calli or ldftn opcodes

Related