Detecting reflective DLL loading with Windows Defender ATPToday's attacks put emphasis on leaving little, if any, forensic evidence to maintain stealth and achieve persistence. Attackers use methods that allow exploits to stay resident within an exploited process or migrate to a long-lived process without ever creating or relying on a file on disk. In recent blogs we described how attackers use basic...
Source:
Detecting reflective DLL loading with Windows Defender ATP
