Adding execute-shellcode-via-enumuilanguages.yml

2026-09-02 03:17:19 +00:00 · 2021-12-04 18:46:44 +08:00 · 2021-12-04 18:46:44 +08:00 · e431c428f0
commit e431c428f0
parent b1cefa437e
1 changed files with 15 additions and 0 deletions
--- a/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
+++ b/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: execute shellcode via EnumUILanguages
+    namespace: load-code/shellcode
+    author: jakub.jozwiak@mandiant.com
+    scope: function
+    references:
+      - http://ropgadget.com/posts/abusing_win_functions.html
+      - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/EnumUILanguagesW/EnumUILanguagesW.cpp
+    examples:
+      - ffcf88ead82bdfc159376026f5a9a7da49e593497674bdb6fa7f7d03dd9398d9:0x140001000
+  features:
+    - and:
+      - match: allocate RWX memory
+      - api: EnumUILanguages