From c0b42ae17dbdae4aad6ac82e398144f8ca866754 Mon Sep 17 00:00:00 2001
From: jtothej <95413053+jtothej@users.noreply.github.com>
Date: Sat, 11 Dec 2021 22:07:29 +0800
Subject: [PATCH] Adding execute-shellcode-via-createthreadpoolwait.yml

---
 ...ute-shellcode-via-createthreadpoolwait.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml

diff --git a/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml b/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml
new file mode 100644
index 00000000..68e1affa
--- /dev/null
+++ b/load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml
@@ -0,0 +1,19 @@
+rule:
+  meta:
+    name: execute shellcode via CreateThreadpoolWait
+    namespace: load-code/shellcode
+    author: jakub.jozwiak@mandiant.com
+    scope: function
+    references:
+      - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CreateThreadPoolWait/CreateThreadPoolWait.cpp
+    examples:
+      - a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf:0x10001010
+  features:
+    - and:
+      - match: allocate RWX memory
+      - api: CreateEvent
+      - api: CreateThreadpoolWait
+      - api: SetThreadpoolWait
+      - or:
+        - api: WaitForSingleObject
+        - api: WaitForThreadpoolWaitCallbacks