DLL loaded via a callback function

Identifies module proxying as a method to conceal suspicious callstacks. Adversaries use module proxying the hide the origin of the LoadLibrary call from the callstack by loading the library from the callback function.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1055

Volver a todas las reglas