Bypass Record
Reflective Code Loading × Microsoft Defender XDR
A publicly-reported instance of Reflective Code Loading bypassing Microsoft Defender XDR, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The loader downloads a 64-bit PE file from a remote URL into memory, parses its headers, allocates memory within the calling process, maps sections, resolves imports, applies relocations, sets memory protections, and executes the entry point—all without writing to disk. This bypasses EDR by executing code inside a process that has already passed initial security checks.
Detection & mitigation
Monitor for suspicious memory allocation patterns (e.g., VirtualAlloc with PAGE_EXECUTE_READWRITE) and thread creation within trusted processes, especially when followed by network connections to download additional code. Enforce application control and code integrity policies to restrict unsigned code execution in memory.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.