Add capa rule load-code/shellcode/execute-shellcode-via-windows-callback-function.yml (#744)

* Add capa rule load-code/shellcode/execute-shellcode-via-callback-functions.yml

* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update load-code/shellcode/execute-shellcode-via-callback-functions.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update execute-shellcode-via-callback-functions.yml

Omitted A and W on WinAPI function names since capa handles this automatically.

* Update execute-shellcode-via-callback-functions.yml

Added EnumTimeFormats and deduplicated EnumSystemCodePages

* Update and rename execute-shellcode-via-callback-functions.yml to execute-shellcode-via-windows-callback-function.yml

Renamed file to execute-shellcode-via-windows-callback-function.yml and merged https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-enumuilanguages.yml

* Delete execute-shellcode-via-enumuilanguages.yml

Delete rule due to merge with execute-shellcode-via-windows-callback-function.yml

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

load-code/shellcode/execute-shellcode-via-windows-callback-function.yml

@@ -0,0 +1,42 @@
+rule:
+  meta:
+    name: execute shellcode via Windows callback function
+    namespace: load-code/shellcode
+    authors:
+      - ervin.ocampo@mandiant.com
+      - jakub.jozwiak@mandiant.com
+    description: Detect usage of various WinAPI functions that accept callback functions as parameters in order to execute arbitrary shellcode
+    scope: function
+    att&ck:
+      - Defense Evasion::Reflective Code Loading [T1620]
+    mbc:
+      - Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]
+    references:
+      - https://github.com/ChaitanyaHaritash/Callback_Shellcode_Injection
+      - https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
+      - http://ropgadget.com/posts/abusing_win_functions.html
+      - https://github.com/aahmad097/AlternativeShellcodeExec/
+    examples:
+      - 10cd7afd580ee9c222b0a87ff241d306:0x10008BE0
+      - 268d61837aa248c1d49a973612a129ce:0x1000CEC0
+      - 4a2992b4c7a1573bf7c74065e3bf5b0d:0x1000D050
+      - 43db867967c71bd3aaba9a9a3084e7fa:0x140001000
+  features:
+    - and:
+      - match: allocate RWX memory
+      - or:
+        - api: EnumDateFormats
+        - api: GrayString
+        - api: LineDDA
+        - api: EnumChildWindows
+        - api: EnumDesktops
+        - api: EnumDesktopWindows
+        - api: EnumSystemCodePages
+        - api: EnumSystemGeoID
+        - api: EnumSystemLanguageGroups
+        - api: EnumSystemLocales
+        - api: EnumThreadWindows
+        - api: EnumUILanguages
+        - api: EnumWindows
+        - api: EnumChildWindows
+        - api: EnumTimeFormats