add mbc and att&ck tags

load-code/shellcode/execute-shellcode-via-enumuilanguages.yml

@@ -4,6 +4,8 @@ rule:
     namespace: load-code/shellcode
     author: jakub.jozwiak@mandiant.com
     scope: function
+    mbc:
+      - Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]
     references:
       - http://ropgadget.com/posts/abusing_win_functions.html
       - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/EnumUILanguagesW/EnumUILanguagesW.cpp

load-code/shellcode/execute-shellcode-via-windows-fibers.yml

@@ -4,6 +4,8 @@ rule:
     namespace: load-code/shellcode
     author: jakub.jozwiak@mandiant.com
     scope: function
+    mbc:
+      - Defense Evasion::Process Injection::Injection via Windows Fibers [E1055.m05]
     references:
       - https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber
       - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/FiberContextEdit/Source.cpp

load-code/shellcode/spawn-thread-to-rwx-shellcode.yml

@@ -4,6 +4,9 @@ rule:
     namespace: load-code/shellcode
     author: moritz.raabe@mandiant.com
     scope: function
+    mbc:
+     - Memory::Allocate Memory [C0007]
+     - Process::Create Thread [C0038]
     examples:
       - Practical Malware Analysis Lab 19-02.exe_:0x401230
   features: