diff --git a/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml b/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
deleted file mode 100644
index d7c32ac0..00000000
--- a/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-rule:
-  meta:
-    name: execute shellcode via EnumUILanguages
-    namespace: load-code/shellcode
-    authors:
-      - jakub.jozwiak@mandiant.com
-    scope: function
-    mbc:
-      - Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]
-    references:
-      - http://ropgadget.com/posts/abusing_win_functions.html
-      - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/EnumUILanguagesW/EnumUILanguagesW.cpp
-    examples:
-      - ffcf88ead82bdfc159376026f5a9a7da49e593497674bdb6fa7f7d03dd9398d9:0x140001000
-  features:
-    - and:
-      - match: allocate RWX memory
-      - api: EnumUILanguages
diff --git a/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml b/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
new file mode 100644
index 00000000..a95f9d2d
--- /dev/null
+++ b/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
@@ -0,0 +1,42 @@
+rule:
+  meta:
+    name: execute shellcode via Windows callback function
+    namespace: load-code/shellcode
+    authors:
+      - ervin.ocampo@mandiant.com
+      - jakub.jozwiak@mandiant.com
+    description: Detect usage of various WinAPI functions that accept callback functions as parameters in order to execute arbitrary shellcode
+    scope: function
+    att&ck:
+      - Defense Evasion::Reflective Code Loading [T1620]
+    mbc:
+      - Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]
+    references:
+      - https://github.com/ChaitanyaHaritash/Callback_Shellcode_Injection
+      - https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
+      - http://ropgadget.com/posts/abusing_win_functions.html
+      - https://github.com/aahmad097/AlternativeShellcodeExec/
+    examples:
+      - 10cd7afd580ee9c222b0a87ff241d306:0x10008BE0
+      - 268d61837aa248c1d49a973612a129ce:0x1000CEC0
+      - 4a2992b4c7a1573bf7c74065e3bf5b0d:0x1000D050
+      - 43db867967c71bd3aaba9a9a3084e7fa:0x140001000
+  features:
+    - and:
+      - match: allocate RWX memory
+      - or:
+        - api: EnumDateFormats
+        - api: GrayString
+        - api: LineDDA
+        - api: EnumChildWindows
+        - api: EnumDesktops
+        - api: EnumDesktopWindows
+        - api: EnumSystemCodePages
+        - api: EnumSystemGeoID
+        - api: EnumSystemLanguageGroups
+        - api: EnumSystemLocales
+        - api: EnumThreadWindows
+        - api: EnumUILanguages
+        - api: EnumWindows
+        - api: EnumChildWindows
+        - api: EnumTimeFormats