XWorm - Reflective Plugin Loading (T1620)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Identifies XWorm dynamically identifying and invoking the Run method of a reflected plugin assembly using .NET late binding. This detection specifically looks for 'LdrLoadDllApiCall' events where 'mscoree.dll' is loaded by a process whose filename matches 'Win.Kernel_Svc'.