Wiki › Techniques, Tactics & Procedures (TTPs) › Execution › Dynamic Code Execution in Memory

Dynamic Code Execution in Memory

2 min read

Jump to:

Overview

Dynamic Code Execution in Memory is a technique used by adversaries to run code directly within a system’s memory without writing it to disk. This approach facilitates stealthy execution, bypassing traditional file-based detection mechanisms and enabling attackers to maintain persistence, escalate privileges, or move laterally within a network.

Attack Objective

Achieve stealthy execution and maintain control over a compromised system
Supports multiple stages including Execution, Persistence, Privilege Escalation, Defense Evasion, and Lateral Movement
Advances the attacker’s position by avoiding disk-based detection and enabling rapid, flexible code deployment

How the Technique Works

Adversaries inject or load executable code directly into the memory space of a process, often leveraging legitimate system utilities or APIs to allocate memory, write code, and execute it dynamically. This avoids creating files on disk, reducing forensic footprints and complicating detection efforts. Execution may occur via scripting engines, reflective DLL injection, or just-in-time compilation mechanisms.

Common Methods & Variations

Reflective DLL injection, process hollowing, and code injection via Windows API calls such as VirtualAlloc and CreateRemoteThread
Variants exist across endpoints, cloud environments, and identity systems, adapting to platform-specific memory management and execution models
Use of living-off-the-land binaries (LOLBins) and scripting environments (e.g., PowerShell, JavaScript) versus custom-developed loaders or shellcode

Indicators of Compromise (IOCs)

Unusual memory allocation patterns and process injections detected in endpoint telemetry
Execution of scripts or commands that allocate and execute memory without corresponding disk artifacts
Network anomalies caused by in-memory command and control communications

Detection Strategies

Monitoring endpoint process behavior and memory usage through EDR and endpoint monitoring tools
Behavioral detection focusing on suspicious API calls, anomalous process creation, and memory manipulation rather than relying solely on signatures
Correlation of memory execution events with network and identity telemetry to identify coordinated malicious activity

Mitigation & Prevention

Application whitelisting and restricting execution privileges to limit unauthorized code execution
Enforcing memory protection policies such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR)
Implementing least privilege principles and multi-factor authentication to reduce the impact of compromised credentials

Response Considerations

Immediate isolation of affected systems to prevent further in-memory execution and lateral movement
Comprehensive memory forensics and process analysis to identify injected code and entry points
Post-incident hardening including patching vulnerable software, updating detection rules, and reviewing privilege assignments

Related Techniques

Process Injection and Process Hollowing as complementary methods for in-memory code execution
Credential Dumping and Lateral Movement techniques that leverage dynamic code execution to escalate access and propagate

Mapping & References

MITRE ATT&CK: Execution (T1204), Process Injection (T1055), and Defense Evasion (T1218)
Public research on memory-based attacks and detection methodologies from cybersecurity vendors and incident reports

Tags: Cyber Attack Lifecycle Defense Evasion Dynamic Code Execution endpoint security Execution Techniques Incident Response Memory Injection MITRE ATT&CK Process Injection Threat Detection