From e431c428f0459e0d3fd0fd544462d0b84ea14a81 Mon Sep 17 00:00:00 2001
From: jtothej <95413053+jtothej@users.noreply.github.com>
Date: Sat, 4 Dec 2021 18:46:44 +0800
Subject: [PATCH] Adding execute-shellcode-via-enumuilanguages.yml

---
 .../execute-shellcode-via-enumuilanguages.yml     | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 load-code/shellcode/execute-shellcode-via-enumuilanguages.yml

diff --git a/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml b/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
new file mode 100644
index 00000000..4ec316eb
--- /dev/null
+++ b/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: execute shellcode via EnumUILanguages
+    namespace: load-code/shellcode
+    author: jakub.jozwiak@mandiant.com
+    scope: function
+    references:
+      - http://ropgadget.com/posts/abusing_win_functions.html
+      - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/EnumUILanguagesW/EnumUILanguagesW.cpp
+    examples:
+      - ffcf88ead82bdfc159376026f5a9a7da49e593497674bdb6fa7f7d03dd9398d9:0x140001000
+  features:
+    - and:
+      - match: allocate RWX memory
+      - api: EnumUILanguages