Reynolds ntdll Loader Hijacking via LdrLoadDll and NtMapViewOfSection
Detects Reynolds ransomware's technique of ntdll loader hijacking for process injection, bypassing userland API hooks. This rule identifies suspicious activity by looking for the loading of GDI32.dll alongside ntdll internal loader routines, combined with API calls such as WriteProcessMemory, NtCreateSection, NtMapViewOfSection, and RtlEncodeRemotePointer, which are consistent with loader-level injection techniques. It also filters out common legitimate processes to reduce false positives.
Microsoft Sentinel (KQL)
