type: attack-pattern
spec_version: 2.1
id: attack-pattern--4933e63b-9b77-476e-ab29-761bc5b7d15a
created: 2021-10-05T01:15:06.293Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1620
external_id: T1620
source_name: 00sec Droppers
description: 0x00pico. (2017, September 25). Super-Stealthy Droppers. Retrieved October 4, 2021.
url: https://0x00sec.org/t/super-stealthy-droppers/3715
source_name: S1 Custom Shellcode Tool
description: Bunce, D. (2019, October 31). Building A Custom Tool For Shellcode Analysis. Retrieved October 4, 2021.
url: https://www.sentinelone.com/blog/building-a-custom-tool-for-shellcode-analysis/
source_name: Mandiant BYOL
description: Kirk, N. (2018, June 18). Bring Your Own Land (BYOL) – A Novel Red Teaming Technique. Retrieved October 4, 2021.
url: https://www.mandiant.com/resources/bring-your-own-land-novel-red-teaming-technique
source_name: S1 Old Rat New Tricks
description: Landry, J. (2016, April 21). Teaching an old RAT new tricks. Retrieved October 4, 2021.
url: https://www.sentinelone.com/blog/teaching-an-old-rat-new-tricks/
source_name: MDSec Detecting DOTNET
description: MDSec Research. (n.d.). Detecting and Advancing In-Memory .NET Tradecraft. Retrieved October 4, 2021.
url: https://www.mdsec.co.uk/2020/06/detecting-and-advancing-in-memory-net-tradecraft/
source_name: Microsoft AssemblyLoad
description: Microsoft. (n.d.). Assembly.Load Method. Retrieved February 9, 2024.
url: https://learn.microsoft.com/dotnet/api/system.reflection.assembly.load
source_name: Intezer ACBackdoor
description: Sanmillan, I. (2019, November 18). ACBackdoor: Analysis of a New Multiplatform Backdoor. Retrieved October 4, 2021.
url: https://www.intezer.com/blog/research/acbackdoor-analysis-of-a-new-multiplatform-backdoor/
source_name: Stuart ELF Memory
description: Stuart. (2018, March 31). In-Memory-Only ELF Execution (Without tmpfs). Retrieved October 4, 2021.
url: https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html
source_name: Introducing Donut
description: The Wover. (2019, May 9). Donut - Injecting .NET Assemblies as Shellcode. Retrieved October 4, 2021.
url: https://thewover.github.io/Introducing-Donut/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:44.030Z
name: Reflective Code Loading
description: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)).

Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the `Assembly.Load()` method executed by [PowerShell](https://attack.mitre.org/techniques/T1059/001) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad)

Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: João Paulo de A. Filho, @Hug1nN__
Shlomi Salem, SentinelOne
Lior Ribak, SentinelOne
Rex Guo, @Xiaofei_REX, Confluera
Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics
Jiraput Thamsongkrah
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 1.3