Techniques › T1620
T1620 Reflective Code Loading
stealth — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
3
Sigma rules tagged attack.t1620
0
KEV CVEs mapped here
<p>Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).</p><p>Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode). For example, the
Assembly.Load() method executed by PowerShell may be abused to load raw code into the running process.</p><p>Reflective code injection is very similar to Process Injection except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0300 Detection Strategy for Reflective Code Loading v1.0
AN0838 WindowsDetect anomalous chains of memory allocation and execution inside the same process (e.g., VirtualAlloc → memcpy → VirtualProtect → CreateThread). Unlike process injection, reflective code loading does not perform cross-process memory writes — the suspicious activity occurs entirely within the process’s own PID context.etw:Microsoft-Windows-DotNETRuntime
AssemblyLoad/ModuleLoad (Loader keyword) from Microsoft-Windows-DotNETRuntime→ DC0021 OS API Executionetw:Microsoft-Antimalware-Scan-InterfaceAmsi/Script content + API verdicts during in-memory staging→ DC0029 Script ExecutionTunable:ParentProcessWhitelistMemoryRegionPermissionsAN0839 LinuxMonitor for in-process mmap + mprotect + execve/execveat activity where memory permissions are changed from writable to executable inside the same process without a corresponding ELF on disk.Tunable:ProcessNameScopeRWXMemoryThresholdAN0840 macOSSuspicious calls to dlopen(), dlsym(), or mmap with RWX flags in processes that do not typically perform dynamic module loading. Monitor anonymous memory regions executed by user processes.Tunable:ApplicationScopeExecutionTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1620
Author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community
· 2020-10-06 (modified 2026-04-29) · logsource: product=windows category=ps_script · 03d83090-8cba-44a0-b02f-0b756a050306
Detects usage of WinAPI functions in PowerShell scripts.
It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
Author: Christian Burkard (Nextron Systems), pH-T (Nextron Systems)
· 2022-03-01 (modified 2023-01-30) · logsource: product=windows category=process_creation · 62b7ccc9-23b4-471e-aa15-6da3663c4d59
Detects base64 encoded .NET reflective loading of Assembly
Author: frack113
· 2022-12-25 · logsource: product=windows category=ps_script · ddcd88cb-7f62-4ce5-86f9-1704190feb0a
Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory