Merge branch 'master' of github.com:fireeye/capa-rules

README.md

@@ -1,7 +1,7 @@
 # capa rules
 
 [![Rule linter status](https://github.com/fireeye/capa-rules/workflows/CI/badge.svg)](https://github.com/fireeye/capa-rules/actions?query=workflow%3A%22CI%22)
-[![Number of rules](https://img.shields.io/badge/rules-271-blue.svg)](rules)
+[![Number of rules](https://img.shields.io/badge/rules-272-blue.svg)](rules)
 [![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE.txt)
 
 This is the standard collection of rules for [capa](https://github.com/fireeye/capa) - the tool to automatically identify capabilities of programs.

data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml

@@ -0,0 +1,25 @@
+rule:
+  meta:
+    name: encrypt data using DES via WinAPI
+    namespace: data-manipulation/encryption/des
+    author: "@_re_fox"
+    scope: function
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information [T1027]
+    examples:
+      - 5f66b82558ca92e54e77f216ef4c066c:0x403377
+  features:
+    - and:
+      - or:
+        - number: 0x6601 = CALG_DES
+        - number: 0x6603 = CALG_3DES
+        - number: 0x6609 = CALG_3DES_112
+      - or:
+        - api: CryptGenKey
+        - api: CryptDeriveKey
+        - api: CryptImportKey
+      - optional:
+        - or:
+          - api: CryptAcquireContext
+          - api: CryptEncrypt
+          - api: CryptDecrypt