diff --git a/load-code/pe/parse-pe-exports.yml b/load-code/pe/parse-pe-exports.yml
new file mode 100644
index 00000000..43560fbc
--- /dev/null
+++ b/load-code/pe/parse-pe-exports.yml
@@ -0,0 +1,20 @@
+rule:
+  meta:
+    name: parse PE exports
+    namespace: load-code/pe
+    author: "@Ana06"
+    scope: function
+    references:
+      - Practical Malware Analysis, Chapter 19
+    examples:
+      - E4C33AC3638EEF68311F8AC0D72483C7:0x401390
+  features:
+    - and:
+      - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
+      - or:
+        - offset/x32: 0x78 = IMAGE_NT_HEADERS32.OptionalHeader.DataDirectory.VirtualAddress
+        - offset/x64: 0x88 = IMAGE_NT_HEADERS64.OptionalHeader.DataDirectory.VirtualAddress
+      - offset: 0x18 = IMAGE_EXPORT_DIRECTORY.NumberOfNames
+      - offset: 0x20 = IMAGE_EXPORT_DIRECTORY.AddressOfNames
+      - offset: 0x24 = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals
+      - offset: 0x1C = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions