T1620 — Reflective Code Loading

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared…

Sigma detection rules (3)

T1620 Reflective Code Loading

title: T1620 Reflective Code Loading
id: f21ccb66-bb2f-437c-a004-34867ef4bdfb
description: 'Detects reflective code loading via two Windows-observable proxies: (1) process command lines invoking .NET/PowerShell reflection APIs commonly used to load assemblies/shellcode directly into memory, and (2) unsigned image loads originating from user-writable directories (AppData/Temp/Public) rather than legitimate installation paths. (Data Component: Process Creation, Module Load.) Tune using: ParentProcessWhitelist, TrustedDirectories.'
references:
  - https://attack.mitre.org/techniques/T1620
author: Shahrukh Khan
date: 2026-02-05
license: MIT
tags:
  - attack.stealth
  - attack.t1620

logsource:
  product: windows
  service: sysmon

detection:
  selection_reflection_commandline:
    EventID: 1
    CommandLine|contains:
      - 'Reflection.Assembly'
      - 'Assembly.Load'
      - 'ReflectivePEInjection'
      - 'System.Reflection'
      - 'VirtualAlloc'

  selection_unsigned_module_from_userdir:
    EventID: 7
    Signed: false
    ImageLoaded|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Users\Public\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_reflection_commandline or selection_unsigned_module_from_userdir) and not filter_system_account

falsepositives:
  - Legitimate PowerShell modules/tools using reflection APIs for benign purposes, or portable applications loading unsigned modules from user directories; tune ParentProcessWhitelist/TrustedDirectories.

level: high

T1620 Reflective Code Loading

title: T1620 Reflective Code Loading
id: e9418616-51af-4ee0-8ad0-9aa63da553f2
description: 'Detection Strategy for Reflective Code Loading. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProcessNameScope, RWXMemoryThreshold.'
references:
  - https://attack.mitre.org/techniques/T1620
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.stealth
  - attack.t1620

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: SYSCALL
    syscall: memfd_create
    comm|contains:
      - 'python3'
      - 'perl'
      - 'bash'

  condition: selection

falsepositives:
  - memfd_create is used legitimately by systemd, Chromium sandboxing, and some package managers for in-memory temp files; reliably confirming reflective loading also requires observing an RWX mmap/mprotect on the resulting fd, which needs a dedicated mmap syscall audit rule beyond process_creation telemetry (tune RWXMemoryThreshold cannot be evaluated from EXECVE alone).

level: high

T1620 Reflective Code Loading

title: T1620 Reflective Code Loading
id: 8b4f5032-086a-4d5f-a357-bcc77ae307e3
description: 'Detection Strategy for Reflective Code Loading. (Retargeted to the image_load macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ApplicationScope, ExecutionTimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1620
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.stealth
  - attack.t1620

logsource:
  category: image_load
  product: macos

detection:
  selection:
    ImageLoaded|contains:
      - '/tmp/'
      - '/private/tmp/'
      - '/var/folders/'
  filter_apple:
    Image|startswith: '/System/Library/'

  condition: selection and not filter_apple

falsepositives:
  - True in-memory reflective loading with no backing file on disk is invisible to image_load telemetry; this rule only catches disk-backed loads staged from temporary directories and will miss fully memory-resident loaders.

level: high

Explore