From be2c552cfff69199d2d91e11a8a371b4eb6d7835 Mon Sep 17 00:00:00 2001
From: Ana Maria Martinez Gomez <anamaria.martinezgom@mandiant.com>
Date: Wed, 24 Mar 2021 12:16:18 +0100
Subject: [PATCH] add load-code/pe/inject-dll-reflectively.yml

Identify reflective dll injection using `copy PE sections` and `rebuild
import table`.
References:
- https://0x00sec.org/t/reflective-dll-injection/3080
- https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
---
 load-code/pe/inject-dll-reflectively.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 load-code/pe/inject-dll-reflectively.yml

diff --git a/load-code/pe/inject-dll-reflectively.yml b/load-code/pe/inject-dll-reflectively.yml
new file mode 100644
index 00000000..4227412d
--- /dev/null
+++ b/load-code/pe/inject-dll-reflectively.yml
@@ -0,0 +1,20 @@
+rule:
+  meta:
+    name: inject DLL reflectively
+    namespace: load-code/pe
+    author: "@Ana06"
+    scope: function
+    references:
+      - https://0x00sec.org/t/reflective-dll-injection/3080
+      - https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection
+    examples:
+      - E4C33AC3638EEF68311F8AC0D72483C7:0x401510
+  features:
+    - and:
+      - match: enumerate PE sections
+      - match: rebuild import table
+      - basic block:
+        - and:
+          - offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint
+          - number: 0x1 = DLL_PROCESS_ATTACH
+          - characteristic: indirect call = call entry point