Dynamic API Resolution via GetProcAddress Payload

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects network traffic, specifically HTTP responses (flow:to_client), that contain the strings "GetProcAddress" and "LoadLibraryA" (case-insensitive). These strings are commonly associated with dynamic API resolution techniques used by malware to load functions at runtime, often to evade static analysis. The rule is classified as detecting trojan activity.