execute-dotnet-assembly-via-clr-host.yml

# generated using capa explorer for IDA Pro
rule:
  meta:
    name: execute .NET assembly via CLR host
    namespace: load-code/dotnet
    authors:
      - blas.kojusner@mandiant.com
    description: may be used to evade hooks or hinder analysis
    scope: function
    references:
      - https://github.com/TheWover/donut/blob/master/DonutTest/rundotnet.cpp
    examples:
      - 6CD1315F6F2FA4F8EE2B98BB3CA0A994:0x140001030
  features:
    - and:
      - bytes: 23 67 2F CB 3A AB D2 11 9C 40 00 C0 4F A3 0A 3E = CLSID_CorRuntimeHost
      - bytes: 22 67 2F CB 3A AB D2 11 9C 40 00 C0 4F A3 0A 3E = IID_ICorRuntimeHost
      - api: CorBindToRuntime
      - optional:
        - basic block:
          - or:
            - and:
              - operand[0].offset: 0x50 = Start
              - characteristic: indirect call
            - and:
              - operand[0].offset: 0x68 = GetDefaultDomain
              - characteristic: indirect call
      - api: SafeArrayCreate