Reflective Code Loading
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)). Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position...
BY SOURCE
PROCEDURES (9)
Auto-extracted: 3 detections for general monitoring
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for reflection
Auto-extracted: 1 detections for kernel monitoring
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for suspicious