From ff739c32468b2754ce8890dd8589b7083ea6b341 Mon Sep 17 00:00:00 2001
From: re-fox <57954766+re-fox@users.noreply.github.com>
Date: Tue, 28 Jul 2020 15:17:07 -0400
Subject: [PATCH 1/2] Create encrypt-data-using-des-via-winapi.yml

---
 .../des/encrypt-data-using-des-via-winapi.yml | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml

diff --git a/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml b/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml
new file mode 100644
index 00000000..f49dd221
--- /dev/null
+++ b/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml
@@ -0,0 +1,25 @@
+rule:
+  meta:
+    name: encrypt data using DES via WinAPI
+    namespace: data-manipulation/encryption/des
+    author: "@_re_fox"
+    scope: function
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information [T1027]
+    examples:
+      - 5f66b82558ca92e54e77f216ef4c066c:0x403377
+  features:
+    - and:
+      - or:
+        - number: 0x6601 = CALG_DES
+        - number: 0x6603 = CALG_3DES
+        - number: 0x6609 = CALG_3DES_112
+      - or:
+        - api: CryptGenKey
+        - api: CryptDeriveKey
+        - api: CryptImportKey
+      - optional:
+        - or:
+          - api: CryptAcquireContext
+          - api: CryptEncrypt
+          - api: CryptDecrypt 

From dbbb9287405b3ef843de7027c5d64a53103e2f38 Mon Sep 17 00:00:00 2001
From: Capa Bot <capa-dev@fireeye.com>
Date: Tue, 28 Jul 2020 19:59:24 +0000
Subject: [PATCH 2/2] Update rules number badge

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 929cd319..68e3997d 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # capa rules
 
 [![Rule linter status](https://github.com/fireeye/capa-rules/workflows/CI/badge.svg)](https://github.com/fireeye/capa-rules/actions?query=workflow%3A%22CI%22)
-[![Number of rules](https://img.shields.io/badge/rules-271-blue.svg)](rules)
+[![Number of rules](https://img.shields.io/badge/rules-272-blue.svg)](rules)
 [![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE.txt)
 
 This is the standard collection of rules for [capa](https://github.com/fireeye/capa) - the tool to automatically identify capabilities of programs.