An attacker uses the technique of 'reflective DLL injection' to load a malicious DLL into a process without touching the disk. What makes this technique particularly effective at evading traditional defenses?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because reflective DLL injection implements its own loader within the DLL payload, allowing it to be mapped into process memory from a buffer (received over network, from another process, etc.) without ever being written to disk — evading file-based AV, file system monitoring, and leaving no disk artifact for forensic recovery. A is wrong because reflective injection uses a malicious custom DLL, not a legitimate signed Windows DLL.
Full explanation below image
Full Explanation
B is correct because reflective DLL injection implements its own loader within the DLL payload, allowing it to be mapped into process memory from a buffer (received over network, from another process, etc.) without ever being written to disk — evading file-based AV, file system monitoring, and leaving no disk artifact for forensic recovery. A is wrong because reflective injection uses a malicious custom DLL, not a legitimate signed Windows DLL. C is wrong because reflective injection works on both 32-bit and 64-bit processes; modern EDR solutions monitor both architectures. D is wrong because reflective injection operates in user-space via Windows API calls; it does not require kernel driver access.