T1620 Reflective Code Loading

Technique: T1620
Tactics: Defense Evasion
Research, 90 days: 3
KEV CVEs mapped: 0
SigmaHQ rules: 3
Elastic, Splunk: 12
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1620

MITRE description

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)). Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the `Assembly.Load()` method executed by [PowerShell](https://attack.mitre.org/techniques/T1059/001) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad) Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
2026-09-17 ESET: Beware the SparroWock: The backdoor that bites, the commands that catch
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

Elastic and Splunk rules

Suspicious Java Class File Created in PaperCut Server Library (elastic)
Suspicious Process Execution Detected via Defend for Containers (elastic)
Memory Threat - Detected - Elastic Defend (elastic)
Memory Threat - Prevented- Elastic Defend (elastic)
Potential Fileless Execution via Unusual memfd Create Call (elastic)
Process Started with Executable Stack (elastic)
Network Connection from Binary with RWX Memory Region (elastic)
Unknown Execution of Binary with RWX Memory Region (elastic)
Suspicious .NET Reflection via PowerShell (elastic)
Suspicious Managed Code Hosting Process (elastic)
PowerShell PInvoke Process Injection API Chain (splunk)
Windows MMC Loaded Script Engine DLL (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.