add create executable heap rule (#1058)

2026-10-12 02:18:39 +00:00 · 2025-08-04 12:40:42 -06:00
parent 47ee3a8777
commit 2f09b4d471
1 changed files with 26 additions and 0 deletions
@@ -0,0 +1,26 @@
+rule:
+  meta:
+    name: create executable heap
+    namespace: load-code/shellcode
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: span of calls
+    mbc:
+      - Memory::Allocate Memory [C0007]
+  features:
+    - and:
+      - or:
+        - basic block:
+          - and:
+            - api: kernel32.HeapCreate
+            - number: 0x40000 = HEAP_CREATE_ENABLE_EXECUTE
+        - call:
+          - and:
+            - api: kernel32.HeapCreate
+            - number: 0x40000 = HEAP_CREATE_ENABLE_EXECUTE
+      - optional:
+        - api: msvcrt.memcpy
+        - api: ntdll.RtlCopyMemory
+        - api: ntdll.RtlMoveMemory