Cross-source coverage

T1620 / ATT&CK

Reflective Code Loading

47 rules across 6 sources.

From MITRE ATT&CK 19.2

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode). For example, the Assembly.Load() method executed by PowerShell may be abused to load raw code into the running process.

Reflective code injection is very similar to Process Injection except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.

Tactics
Stealth
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:Sysmonetw:Microsoft-Windows-DotNETRuntimeetw:Microsoft-Antimalware-Scan-Interfaceauditd:SYSCALLauditd:MMAPmacos:unifiedlog

How MITRE says to detect it DET0300

Detection Strategy for Reflective Code Loading

Windows Analytic 0838

Detect anomalous chains of memory allocation and execution inside the same process (e.g., VirtualAlloc → memcpy → VirtualProtect → CreateThread). Unlike process injection, reflective code loading does not perform cross-process memory writes — the suspicious activity occurs entirely within the process’s own PID context.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=7
  • etw:Microsoft-Windows-DotNETRuntime AssemblyLoad/ModuleLoad (Loader keyword) from Microsoft-Windows-DotNETRuntime
  • etw:Microsoft-Antimalware-Scan-Interface Amsi/Script content + API verdicts during in-memory staging
  • WinEventLog:Sysmon EventCode=10

Linux Analytic 0839

Monitor for in-process mmap + mprotect + execve/execveat activity where memory permissions are changed from writable to executable inside the same process without a corresponding ELF on disk.

  • auditd:SYSCALL execve
  • auditd:MMAP memory region with RWX permissions allocated

macOS Analytic 0840

Suspicious calls to dlopen(), dlsym(), or mmap with RWX flags in processes that do not typically perform dynamic module loading. Monitor anonymous memory regions executed by user processes.

  • macos:unifiedlog execve or dylib load from memory without backing file
  • macos:unifiedlog suspicious dlopen/dlsym usage in non-development processes

View on attack.mitre.org ↗

elastic/protections-artifacts

31 rules
Detection Severity Format
API Call from Inaccessible Memory Page Undefined Elastic TOML
Binary Executed from Shared Memory Directory Undefined Elastic TOML
Egress Network Connection Followed by Memory File Descriptor Creation Undefined Elastic TOML
Egress Network Connection from Memory File Descriptor Undefined Elastic TOML
Execution of Memory File Descriptor via Interactive Session Undefined Elastic TOML
Execution of Memory File Descriptor via Suspicious Process Undefined Elastic TOML
File Creation or Modification via (Memory) File Descriptor Undefined Elastic TOML
In-Memory JXA Execution via ScriptingAdditions Undefined Elastic TOML
Loadable Kernel Module Load via Forked Memory File Descriptor Undefined Elastic TOML
Memory File Descriptor Child Process Execution Undefined Elastic TOML

+ 21 more from elastic/protections-artifacts → showing the 10 highest-severity

elastic/detection-rules

8 rules
Detection Severity Format
Memory Threat - Detected - Elastic Defend High Elastic TOML
Memory Threat - Prevented- Elastic Defend High Elastic TOML
Suspicious Managed Code Hosting Process High Elastic TOML
Suspicious Process Execution Detected via Defend for Containers High Elastic TOML
Network Connection from Binary with RWX Memory Region Medium Elastic TOML
Suspicious .NET Reflection via PowerShell Medium Elastic TOML
Unknown Execution of Binary with RWX Memory Region Medium Elastic TOML
Process Started with Executable Stack Low Elastic TOML

SigmaHQ/sigma

3 rules
Detection Severity Format
Potential WinAPI Calls Via PowerShell Scripts High Sigma
PowerShell Base64 Encoded Reflective Assembly Load High Sigma
Potential In-Memory Execution Using Reflection.Assembly Medium Sigma

socfortress/Wazuh-Rules

2 rules
Detection Severity Format
Powershell script: Dynamic assembly building detected High Wazuh XML
Sysmon - Event 1: Process creation · Reflective Code Loading via WinPwn (T1620) High Wazuh XML

splunk/security_content

2 rules
Detection Severity Format
PowerShell PInvoke Process Injection API Chain Undefined SPL
Windows MMC Loaded Script Engine DLL Undefined SPL

falcosecurity/rules

1 rule
Detection Severity Format
Fileless execution via memfd_create Critical Falco YAML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.