From 4ea6e93ed9e7e42e92b824241c6aa48e7a6e576c Mon Sep 17 00:00:00 2001
From: jtothej <95413053+jtothej@users.noreply.github.com>
Date: Sun, 12 Dec 2021 18:19:18 +0800
Subject: [PATCH] Adding execute-shellcode-via-copyfile2.yml

---
 .../execute-shellcode-via-copyfile2.yml       | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 load-code/shellcode/execute-shellcode-via-copyfile2.yml

diff --git a/load-code/shellcode/execute-shellcode-via-copyfile2.yml b/load-code/shellcode/execute-shellcode-via-copyfile2.yml
new file mode 100644
index 00000000..b7dbd5db
--- /dev/null
+++ b/load-code/shellcode/execute-shellcode-via-copyfile2.yml
@@ -0,0 +1,28 @@
+rule:
+  meta:
+    name: execute shellcode via CopyFile2
+    namespace: load-code/shellcode
+    author: jakub.jozwiak@mandiant.com
+    scope: function
+    references:
+      - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CopyFile2/CopyFile2.cpp
+    examples:
+      - c2bb17c12975ea61ff43a71afd9c3ff111d018af161859abae0bdb0b3dae98f9:0x140001010
+  features:
+    - and:
+      - or:
+        - match: allocate RWX memory
+        - basic block:
+          - and:
+            # xor     ecx, ecx        ; lpAddress
+            # mov     edx, 31Fh       ; dwSize
+            # mov     r8d, 1000h      ; flAllocationType
+            # lea     r9d, [rcx+40h]  ; flProtect
+            # call    cs:VirtualAlloc
+            - match: allocate memory
+            - mnemonic: lea
+            - offset: 0x40
+      - api: CopyFile2
+      - api: DeleteFileW
+      - number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS
+      - number: 0x20 = sizeof(COPYFILE2_EXTENDED_PARAMETERS)