{"id":"T1620","name":"Reflective Code Loading","url":"https://attack.mitre.org/techniques/T1620","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0300","stix_id":"x-mitre-detection-strategy--dc415caf-2f8f-4208-8aa8-7db10729cbfb","name":"Detection Strategy for Reflective Code Loading","url":"https://attack.mitre.org/detectionstrategies/DET0300","analytics":[{"id":"AN0838","stix_id":"x-mitre-analytic--2432f5a3-ddae-4138-9981-f916ad23a1e1","name":"Analytic 0838","description":"Detect anomalous chains of memory allocation and execution inside the same process (e.g., VirtualAlloc → memcpy → VirtualProtect → CreateThread). Unlike process injection, reflective code loading does not perform cross-process memory writes — the suspicious activity occurs entirely within the process’s own PID context.","url":"https://attack.mitre.org/detectionstrategies/DET0300#AN0838","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"etw:Microsoft-Windows-DotNETRuntime","channel":"AssemblyLoad/ModuleLoad (Loader keyword) from Microsoft-Windows-DotNETRuntime","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"etw-microsoft-windows-dotnetruntime"},{"name":"etw:Microsoft-Antimalware-Scan-Interface","channel":"Amsi/Script content + API verdicts during in-memory staging","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"etw-microsoft-antimalware-scan-interface"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ParentProcessWhitelist","description":"Certain processes may legitimately use Assembly.Load(); defenders may whitelist known developer/admin tools."},{"field":"MemoryRegionPermissions","description":"Detection logic can tune for RWX memory allocations; some legitimate tools may allocate with RW permissions only."}],"live":true,"detection_strategies":["DET0300"],"techniques":["T1620"]},{"id":"AN0839","stix_id":"x-mitre-analytic--cfdd2422-7e68-417a-9298-062bac59df0c","name":"Analytic 0839","description":"Monitor for in-process mmap + mprotect + execve/execveat activity where memory permissions are changed from writable to executable inside the same process without a corresponding ELF on disk.","url":"https://attack.mitre.org/detectionstrategies/DET0300#AN0839","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:MMAP","channel":"memory region with RWX permissions allocated","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"auditd-mmap"}],"mutable_elements":[{"field":"ProcessNameScope","description":"Uncommon for service binaries to call memfd_create; detection tuned for high-risk processes."},{"field":"RWXMemoryThreshold","description":"Adjust threshold for allowed RWX allocations to reduce false positives in JIT runtimes."}],"live":true,"detection_strategies":["DET0300"],"techniques":["T1620"]},{"id":"AN0840","stix_id":"x-mitre-analytic--da7cf744-fc04-4b17-8a96-3140a4b349d6","name":"Analytic 0840","description":"Suspicious calls to dlopen(), dlsym(), or mmap with RWX flags in processes that do not typically perform dynamic module loading. Monitor anonymous memory regions executed by user processes.","url":"https://attack.mitre.org/detectionstrategies/DET0300#AN0840","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"execve or dylib load from memory without backing file","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"suspicious dlopen/dlsym usage in non-development processes","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ApplicationScope","description":"Developer tools may legitimately call dlopen/dlsym; narrow scope to production workloads."},{"field":"ExecutionTimeWindow","description":"Correlate suspicious loads with subsequent process activity in a defined window."}],"live":true,"detection_strategies":["DET0300"],"techniques":["T1620"]}],"live":true,"version":"1.0","techniques":["T1620"]}],"sigma_rules":[{"id":"03d83090-8cba-44a0-b02f-0b756a050306","title":"Potential WinAPI Calls Via PowerShell Scripts","author":"Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-06","modified":"2026-04-29","description":"Detects usage of WinAPI functions in PowerShell scripts.\nIt may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.\nThese techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.\n","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse","https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1","https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.t1106","attack.stealth","attack.t1620"],"path":"rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml","techniques":["T1059.001","T1106","T1620"],"cves":[]},{"id":"62b7ccc9-23b4-471e-aa15-6da3663c4d59","title":"PowerShell Base64 Encoded Reflective Assembly Load","author":"Christian Burkard (Nextron Systems), pH-T (Nextron Systems)","status":"test","level":"high","date":"2022-03-01","modified":"2023-01-30","description":"Detects base64 encoded .NET reflective loading of Assembly","references":["https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar","https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027","attack.t1620"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml","techniques":["T1059.001","T1027","T1620"],"cves":[]},{"id":"ddcd88cb-7f62-4ce5-86f9-1704190feb0a","title":"Potential In-Memory Execution Using Reflection.Assembly","author":"frack113","status":"test","level":"medium","date":"2022-12-25","modified":null,"description":"Detects usage of \"Reflection.Assembly\" load functions to dynamically load assemblies in memory","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1620"],"path":"rules/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file.yml","techniques":["T1620"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}