add load-code/pe/inject-dll-reflectively.yml

Identify reflective dll injection using `copy PE sections` and `rebuild
import table`.
References:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection

load-code/pe/inject-dll-reflectively.yml

@@ -0,0 +1,20 @@
+rule:
+  meta:
+    name: inject DLL reflectively
+    namespace: load-code/pe
+    author: "@Ana06"
+    scope: function
+    references:
+      - https://0x00sec.org/t/reflective-dll-injection/3080
+      - https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
+    examples:
+      - E4C33AC3638EEF68311F8AC0D72483C7:0x401510
+  features:
+    - and:
+      - match: enumerate PE sections
+      - match: rebuild import table
+      - basic block:
+        - and:
+          - offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint
+          - number: 0x1 = DLL_PROCESS_ATTACH
+          - characteristic: indirect call = call entry point