In-Memory DLL Reflective Execution Sequence (T1620)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•3

This rule detects fileless reflective loading behavior where a process performs an in-memory DLL load (specifically 'mscoree.dll' via 'LdrLoadDllApiCall') and is immediately followed by an outbound network connection within a 5-minute window. This sequence is indicative of techniques used for in-memory execution and command and control (C2) communication.