Reflective DLL inject

Invoke-ReflectivePEInjection -PEBytes <bytes>

Reflectively injects a PE into the test host, validating detection of injection without touching disk (reflective DLL injection).

Run it in the purple team lab when you want to validate detection of reflective injection: Invoke-ReflectivePEInjection loads the PE into the process memory (without writing the file to disk) and the team verifies what was detected — Event 4104 (the script), Sysmon Event 10/8, SIEM rules, EDR. It's the validation of in-memory injection: the technique of loaders that don't touch disk. In purple teaming, reflective injection validates the detection layer of in-memory loading — the scenario that file analysis doesn't see.

Don't run it outside the lab: the injection loads the PE into the process (the actual activity) — the test host is the place. And note: the PowerShell with the injection remains in 4104 (ScriptBlock Logging records it) — the validation measures that layer and the EDR's (the anomalous in-memory load); without logging, PowerShell injection goes unnoticed. The variant with a custom loader (without PowerShell) is validated separately — detection of in-memory loading is the common layer. Cleanup (processes with the injected PE) upon completion.