Adding execute-shellcode-via-copyfile2.yml

load-code/shellcode/execute-shellcode-via-copyfile2.yml

@@ -0,0 +1,28 @@
+rule:
+  meta:
+    name: execute shellcode via CopyFile2
+    namespace: load-code/shellcode
+    author: jakub.jozwiak@mandiant.com
+    scope: function
+    references:
+      - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CopyFile2/CopyFile2.cpp
+    examples:
+      - c2bb17c12975ea61ff43a71afd9c3ff111d018af161859abae0bdb0b3dae98f9:0x140001010
+  features:
+    - and:
+      - or:
+        - match: allocate RWX memory
+        - basic block:
+          - and:
+            # xor     ecx, ecx        ; lpAddress
+            # mov     edx, 31Fh       ; dwSize
+            # mov     r8d, 1000h      ; flAllocationType
+            # lea     r9d, [rcx+40h]  ; flProtect
+            # call    cs:VirtualAlloc
+            - match: allocate memory
+            - mnemonic: lea
+            - offset: 0x40
+      - api: CopyFile2
+      - api: DeleteFileW
+      - number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS
+      - number: 0x20 = sizeof(COPYFILE2_EXTENDED_PARAMETERS)