⚠️ Overview

sRDI (Shellcode Reflective DLL Injection) is an open-source technique and tool developed by security researcher Nick Cano (alias monoxgas) and first published on GitHub in August 2016. It is not a standalone malware family but a critical capability used by multiple threat actors and post‑exploitation frameworks, including Cobalt Strike and Metasploit, to achieve code execution. sRDI falls under the category of injection and evasion tools, enabling attackers to convert arbitrary DLLs into position‑independent shellcode that can be loaded reflectively into a process without touching disk or invoking standard Windows loader APIs.

🔧 Technical Capabilities

sRDI transforms a DLL into shellcode that contains a minimal reflective loader, allowing the DLL to be injected into a remote process (e.g., explorer.exe) and executed entirely in memory. This technique maps to the MITRE ATT&CK technique T1055.001 (Process Injection: Dynamic‑link Library Injection). The shellcode performs its own relocation, resolves imports via custom logic, and calls the DLL’s entry point, bypassing traditional file‑based detection. Common propagation methods include spear‑phishing attachments, lateral movement via RDP or SMB, and integration with command‑and‑control (C2) frameworks. Persistence mechanisms are not inherent to sRDI itself but are frequently combined with scheduled tasks, services, or Registry Run keys after initial injection. Evasion advantages include the absence of on‑disk artifacts, avoidance of API hooking by using direct system calls, and bypassing of application whitelisting solutions such as AppLocker.

📜 History & Notable Incidents

After its public release, sRDI was quickly adopted by red‑team tools and later by criminal groups. In 2020, FireEye’s M‑Trends report documented the Ryuk ransomware gang using sRDI as part of its post‑compromise toolkit to deliver the ransomware payload (source: FireEye, “Ryuk Ransomware: A Targeted Attack”). The TrickBot group also incorporated sRDI for lateral movement in 2019. No common vulnerabilities and exposures (CVEs) are directly associated with sRDI because it is an exploitation technique rather than a software flaw; however, Microsoft and security vendors have released detections for reflective DLL injection via AMSI and event logging.

🔍 Detection Indicators

Behavioral indicators include unexpected process injection events—particularly the creation of remote threads in legitimate processes such as svchost.exe or rundll32.exe—and memory sections with both WRITE and EXECUTE permissions (MITRE ATT&CK M1055). Network indicators often align with the parent C2 framework, such as Cobalt Strike’s HTTPS beacon patterns or Ryuk’s unique TLS signatures. There are no fixed file hashes because sRDI is a generator tool; instead, detection relies on heuristics, such as the presence of specific shellcode patterns (e.g., the 4‑byte offset for the entry point) and anomalous reflective loader calls observed through Sysmon event ID 8 or Windows Defender’s behavior monitoring.

☠️ Risk & Impact

When weaponized, sRDI enables adversaries to execute arbitrary code in memory, facilitating data exfiltration, lateral movement, and deployment of ransomware or credential stealers. Major incidents attributed to sRDI‑enabled attacks include the Ryuk ransomware campaign that disrupted healthcare organizations, causing estimated losses exceeding tens of millions of dollars. The technique has been observed across finance, government, and industrial sectors, significantly elevating the risk of complete network compromise with minimal forensic footprint.

🛡️ Mitigation

Defenders should enable AMSI for all scripting languages, deploy endpoint detection and response (EDR) rules for process injection (e.g., alerting on CreateRemoteThread calls with anomalous parameters), and block the download/execution of the sRDI generator tool via application control policies. Microsoft’s Attack Surface Reduction rule for “Process Injection via DLL” can also mitigate this technique (ASR rule ID: d1e49aac‑8f56‑4280‑b9e‑f6b2b3a5c3f9).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.