add "check for hooked API"

anti-analysis/anti-vm/vm-detection/check-for-noped-api.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: check for NOPed API
+    namespace: anti-analysis/anti-vm/vm-detection
+    authors:
+      - wballenthin@hex-rays.com
+    scopes:
+      static: function
+      dynamic: unsupported
+    references:
+      - https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/
+    examples:
+      - F3D8530A2B81D1871C2F96E064291AD0:0x140001699
+  features:
+    - and:
+      - api: GetProcAddress
+      - count(match(is NOP byte)): 3 or more

lib/is-nop-byte.yml

@@ -0,0 +1,27 @@
+rule:
+  meta:
+    name: is NOP byte
+    namespace: lib
+    authors:
+      - wballenthin@hex-rays.com
+    description: checks to see if the start of a buffer contains NOP (0x90) bytes
+    scopes:
+      static: instruction
+      dynamic: unsupported
+    examples:
+      - F3D8530A2B81D1871C2F96E064291AD0:0x1400016D9
+  features:
+    - and:
+      - or:
+        - arch: i386
+        - arch: amd64
+      - mnemonic: cmp
+      - or:
+        - operand[0].offset: 0x0
+        # like: cmp     byte ptr [rax+1], 90h
+        - operand[0].offset: 0x1
+        # like: cmp     byte ptr [rax+2], 90h
+        - operand[0].offset: 0x2
+        # like: cmp     byte ptr [rax+3], 90h
+        - operand[0].offset: 0x3
+      - operand[1].number: 0x90