Manual_Win64_System_Call.yar

import "pe"

rule Manual_Win64_System_Call
{
    meta:
        author = "Lloyd @LloydLabs"
        date = "10/07/2021"
        description = "Allows to detect within malware when Windows system calls are manually invoked."

    strings:
        $ = {
          4C 8B D1
          B8 ?? ?? ?? ??
          (0F 05 | CD 2E)
        }

    condition:
        pe.is_pe and all of them
}