Reflective Code Loading T1620
Tactic: Stealth
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).
Events covered
5 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 7 | Image loaded |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| ESF | create | File or Directory Create |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Authoring guide
These 45 rules share fields, values, and exclusions.
Fields filtered most (43 distinct)
These fields appear most often in rule filters.
Top indicator values (360 distinct)
These values appear most often in rule predicates.
Exclusions (768 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 3 rules
- Potential In-Memory Execution Using Reflection.Assembly
- Potential WinAPI Calls Via PowerShell Scripts
- PowerShell Base64 Encoded Reflective Assembly Load
Elastic 40 rules
- API Call from Inaccessible Memory Page
- Binary Executed from Shared Memory Directory
- Egress Network Connection Followed by Memory File Descriptor Creation
- Egress Network Connection from Memory File Descriptor
- Execution of Memory File Descriptor via Interactive Session
- Execution of Memory File Descriptor via Suspicious Process
- File Creation or Modification via (Memory) File Descriptor
- In-Memory JXA Execution via ScriptingAdditions
- Loadable Kernel Module Load via Forked Memory File Descriptor
- Memory File Descriptor Child Process Execution
- Memory File Descriptor Execution from Suspicious Process
- Memory File Descriptor Process Execution
- Memory Threat - Detected - Elastic Defend
- Memory Threat - Prevented- Elastic Defend
- Native API Call from Unsigned Module
- Network Activity from Memory File Descriptor
- Network Activity via (Memory) File Descriptor
- Network Connection from Binary with RWX Memory Region
- NTDLL Memory Protection Change via Unsigned DLL
- Potential Fileless Execution Sequence
- Potential Fileless Execution via Memory File Descriptor by LoLBin
- Potential Fileless Execution via Memory File Descriptor from Interpreter
- Potential Loadable Kernel Module Load via Memory File Descriptor
- Potential Memory File Descriptor Process Execution
- Potential Process Injection via dd
- Potential Shellcode Fluctuation v1
- Process Execution from Boot Directory
- Process Started with Executable Stack
- Reflective Binary Load
- Reflective Dylib Load
- Shellcode API behavior from a signed module
- Shellcode Heap Allocation from Unbacked Memory
- Suspicious .NET Reflection via PowerShell
- Suspicious Java Class File Created in PaperCut Server Library
- Suspicious Managed Code Hosting Process
- Suspicious Memory Page Protection
- Suspicious PowerShell Script with .NET Reflection
- Suspicious Process Execution Detected via Defend for Containers
- Suspicious Windows Core Module Change
- Unknown Execution of Binary with RWX Memory Region