Certain implants that perform DLL sideloading include dummy functions to throw off analysis systems or researchers. For example, in the RedLeaves sample seen here on page 5:
https://www.accenture.com/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf#zoom=50
Could be an idea to to have an option, for example, "allfunctions", and if the DLL package is triggered, to run all exported functions present (as opposed to the "function" option, which allows you to set a specific function yourself).
In the Behavior Analysis, the Process Tree would then allow to determine which function is real or being used.
Certain implants that perform DLL sideloading include dummy functions to throw off analysis systems or researchers. For example, in the RedLeaves sample seen here on page 5:
https://www.accenture.com/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf#zoom=50
Could be an idea to to have an option, for example, "allfunctions", and if the DLL package is triggered, to run all exported functions present (as opposed to the "function" option, which allows you to set a specific function yourself).
In the Behavior Analysis, the Process Tree would then allow to determine which function is real or being used.