diff --git a/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml b/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml
new file mode 100644
index 00000000..5c0fb7ab
--- /dev/null
+++ b/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml
@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: encrypt data using memfrob from glibc
+    namespace: data-manipulation/encryption
+    author: zander.work@mandiant.com
+    scope: function
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information [T1027]
+    mbc:
+      - Defense Evasion::Obfuscated Files or Information::Encryption [E1027.m04]
+      - Cryptography::Encrypt Data [C0027]
+    examples:
+      - 055da8e6ccfe5a9380231ea04b850e18:0x1189
+  features:
+    - api: memfrob