rule:
  meta:
    name: create reverse shell
    namespace: c2/shell
    authors:
      - moritz.raabe@mandiant.com
    scope: function
    att&ck:
      - Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003]
    mbc:
      - Impact::Remote Access::Reverse Shell [B0022.001]
    examples:
      - C91887D861D9BD4A5872249B641BC9F9:0x401A77
  features:
    - or:
      - and:
        - match: create pipe
        - api: kernel32.PeekNamedPipe
        - api: kernel32.CreateProcess
        - api: kernel32.ReadFile
        - api: kernel32.WriteFile
      - and:
        - match: host-interaction/process/create
        - match: read pipe
        - match: write pipe
      - and:
        - match: create pipe
        - match: host-interaction/process/create
        - basic block:
          - and:
            - count(api(SetHandleInformation)): 2 or more
            - number: 1 = HANDLE_FLAG_INHERIT