mandiant-capa-rules/load-code/shellcode/execute-shellcode-via-copyfile2.yml

rule:
  meta:
    name: execute shellcode via CopyFile2
    namespace: load-code/shellcode
    authors:
      - jakub.jozwiak@mandiant.com
    scopes:
      static: function
      dynamic: process
    references:
      - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CopyFile2/CopyFile2.cpp
    examples:
      - c2bb17c12975ea61ff43a71afd9c3ff111d018af161859abae0bdb0b3dae98f9:0x140001010
  features:
    - and:
      - or:
        - match: allocate RWX memory
        - or:
          - basic block:
            - and:
              - match: allocate memory
              - or:
                - number: 0x40
                - instruction:
                  - mnemonic: lea
                  - offset: 64
          - thread:
            - and:
              - match: allocate memory
              - or:
                - number: 0x40
      - api: CopyFile2
      - api: DeleteFileW
      - number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS
      - number: 0x20 = sizeof(COPYFILE2_EXTENDED_PARAMETERS)