Exe Launched By ReflectiveLoader Dll

calendar May 3, 2021  ยท
Share on: linkedin copy

exe launched by dll with ReflectiveLoader export function

Sigma rule (View on GitHub)

 1title: Exe Launched By ReflectiveLoader Dll
 2status: experimental
 3description: exe launched by dll with ReflectiveLoader export function
 4author: Joe Security
 5date: 2019-10-18
 6id: 200001
 7threatname:
 8behaviorgroup: 1
 9classification: 5
10mitreattack: T1055
11
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        ParentCommandLine: '*rundll32.exe C:\\*.dll,ReflectiveLoader*'
18        CommandLine:
19            -'*\\*.exe*'
20    condition: selection
21level: critical
to-top