Reflective DLL Injection Payload in HTTP Response

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the presence of the string "ReflectiveLoader" within HTTP response bodies. This string is commonly associated with Reflective DLL Injection techniques, where a malicious DLL is loaded directly into a process's memory without being written to disk. The detection is case-insensitive and focuses on traffic flowing from the server to the client.