MITRE ATT&CK technique
Reflective Code Loading detection rulesT1620
Reflective Code Loading (T1620) is a MITRE ATT&CK technique in the Stealth tactic. This page lists the 3 community-maintained Sigma detection rules in the library mapped to T1620 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Potential WinAPI Calls Via PowerShell Scripts
highDetects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
windows · ps_script
PowerShell Base64 Encoded Reflective Assembly Load
highDetects base64 encoded .NET reflective loading of Assembly
windows · process_creation
Potential In-Memory Execution Using Reflection.Assembly
mediumDetects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory
windows · ps_script