Bypass Record
Reflective Code Loading × Microsoft Windows Defender
A publicly-reported instance of Reflective Code Loading bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
A Rust PELoader loads a PE file entirely in memory without writing to disk, evading Windows Defender's file-based scanning. The loader manually maps the PE, resolves imports, and executes it, defeating detection that relies on on-disk artifacts.
Detection & mitigation
Monitor for suspicious process memory operations such as VirtualAlloc with PAGE_EXECUTE_READWRITE permissions followed by thread creation, or use of NtCreateThreadEx from non-standard modules. Deploy endpoint detection and response (EDR) with memory scanning capabilities and enable Windows Defender's behavior monitoring and cloud-delivered protection to detect in-memory threats.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.