diff --git a/load-code/pe/rebuild-import-table.yml b/load-code/pe/rebuild-import-table.yml
new file mode 100644
index 00000000..8585935c
--- /dev/null
+++ b/load-code/pe/rebuild-import-table.yml
@@ -0,0 +1,27 @@
+rule:
+  meta:
+    name: rebuild import table
+    namespace: load-code/pe
+    author: "@Ana06"
+    scope: function
+    references:
+      - https://0x00sec.org/t/reflective-dll-injection/3080
+      - https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
+    examples:
+      - E4C33AC3638EEF68311F8AC0D72483C7:0x401510
+  features:
+    - and:
+      - offset: 0x7C = IMAGE_NT_HEADERS.OptionalHeader.DataDirectory.Size
+      - offset: 0x78 = IMAGE_NT_HEADERS.OptionalHeader.DataDirectory.VirtualAddress
+      - basic block:
+        - and:
+          - offset: 0xC = IMAGE_IMPORT_DESCRIPTOR.Name
+          - api: LoadLibraryA
+      - offset: 0x10 = IMAGE_IMPORT_DESCRIPTOR.FirstThunk
+      - api: GetProcAddress
+      - optional: # Optional as may only support import by ordinal or import by name
+        - or:
+          - number/x32: 0x80000000 = IMAGE_SNAP_BY_ORDINAL32
+          - number/x64: 0x8000000000000000 = IMAGE_SNAP_BY_ORDINAL64
+          - number: 0xFFFF = IMAGE_ORDINAL
+          - number: 0x2 = thunk->u1.AddressOfData