T1620: Reflective Code Loading

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode). For example, the Assembly.Load() method executed by PowerShell may be abused to load raw code into the running process.

Reflective code injection is very similar to Process Injection except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

mitre_attck_defense_evasion: PT-CR-1866: Process_Injection_By_MSBuild: Attackers can inject shellcode into other processes by embedding C# code in XML and CSPROJ files for MSBuild to hide malicious activity and avoid detection mitre_attck_defense_evasion: PT-CR-2489: SysmonQuiet_Usage: The Sysmon process has been accessed, which may indicate that the SysmonQuiet module is active. SysmonQuiet is an aggressor script for Cobalt Strike (requires SeDebugPrivilege privilege). SysmonQuiet uses the reflective DLL loading method that automatically locates Sysmon process and patches its EtwEventWrite API, causing Sysmon malfunctioning while the process and its threads are still running.

Detection

IDDS0011Data source and componentModule: Module LoadDescription

Monitor for artifacts of abnormal process execution. For example, a common signature related to reflective code loading on Windows is mechanisms related to the .NET Common Language Runtime (CLR) -- such as mscor.dll, mscoree.dll, and clr.dll -- loading into abnormal processes (such as notepad.exe)

IDDS0012Data source and componentScript: Script ExecutionDescription

Similarly, AMSI / ETW traces can be used to identify signs of arbitrary code execution from within the memory of potentially compromised processes.

IDDS0009Data source and componentProcess: OS API ExecutionDescription

Monitor for code artifacts associated with reflectively loading code, such as the abuse of .NET functions such as Assembly.Load() and Native API functions such as CreateThread(), memfd_create(), execve(), and/or execveat().