rule:
  meta:
    name: execute shellcode via EnumUILanguages
    namespace: load-code/shellcode
    author: jakub.jozwiak@mandiant.com
    scope: function
    references:
      - http://ropgadget.com/posts/abusing_win_functions.html
      - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/EnumUILanguagesW/EnumUILanguagesW.cpp
    examples:
      - ffcf88ead82bdfc159376026f5a9a7da49e593497674bdb6fa7f7d03dd9398d9:0x140001000
  features:
    - and:
      - match: allocate RWX memory
      - api: EnumUILanguages