T1620 Reflective Code Loading
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)). Reflectively loaded payloads may be compiled…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Potential WinAPI Calls Via PowerShell Scriptshightest · windows
- PowerShell Base64 Encoded Reflective Assembly Loadhightest · windows
- Potential In-Memory Execution Using Reflection.Assemblymediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.