Suspicious activity from a reflected process

Detects the execution of a process clone via RtlCreateProcessReflection followed by network activity or loading of common networking DLLs. This behaviour may indicate that an attacker is abusing process reflection for shellcode injection.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1055

Volver a todas las reglas