Reflective DLL Injection

Overview

Reflective DLL Injection is a technique used by adversaries to inject a Dynamic Link Library (DLL) into the address space of a target process without using the Windows loader. This method enables stealthy code execution and is commonly employed during various stages of an attack lifecycle to evade detection and maintain persistence.

Attack Objective

• Achieve stealthy code execution within a legitimate process
• Supports multiple stages including Execution, Persistence, Privilege Escalation, and Defense Evasion
• Advances attacker position by enabling in-memory execution of malicious payloads without touching disk or triggering standard loading mechanisms

How the Technique Works

Reflective DLL Injection involves manually loading a DLL into a target process’s memory space by mapping the DLL image and resolving its dependencies and imports without invoking the operating system’s standard loader. This allows the injected code to run within the context of the target process, often bypassing security controls that monitor typical DLL loading activities.

Common Methods & Variations

• Manual mapping of DLLs into remote processes using custom loaders
• Injection into on-premise endpoints or servers; less common in cloud environments due to differing process models
• Use of living-off-the-land binaries (LOLBins) or custom tooling to perform injection

Indicators of Compromise (IOCs)

• Unusual process behavior such as unexpected DLLs loaded in memory
• Suspicious API calls related to memory allocation, writing, and thread creation in processes
• Endpoint telemetry showing anomalous process injection events

Detection Strategies

• Monitoring endpoint process creation and memory manipulation APIs
• Behavioral detection focusing on anomalous in-memory module loading patterns
• Correlation of process injection events with other suspicious activities such as privilege escalation or lateral movement

Mitigation & Prevention

• Implement application whitelisting and code integrity policies to restrict unauthorized code execution
• Enforce least privilege principles to limit process access rights
• Use endpoint detection and response (EDR) solutions capable of detecting in-memory injection techniques

Response Considerations

• Immediately isolate affected systems to prevent further lateral movement
• Conduct memory forensics to identify injected modules and understand attacker activity
• Apply patches and harden configurations to prevent re-injection and exploitation

Related Techniques

• Process Injection techniques such as DLL Search Order Hijacking and Process Hollowing
• Privilege Escalation methods that leverage injected code to elevate access
• Defense Evasion tactics involving in-memory execution and obfuscation

Mapping & References

• MITRE ATT&CK: T1055 (Process Injection)
• Public research articles on reflective DLL injection and manual mapping techniques
• Security advisories detailing detection and mitigation of in-memory injection attacks