Reflective DLL Loading Payload Detected in HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects the presence of the string "ReflectiveLoader" in HTTP response bodies, which is indicative of a Reflective DLL Loading payload. Reflective DLL loading is a technique used by attackers to load a DLL into a process without the need for the DLL to be present on disk, often used for defense evasion.