decrypt data using AES via x86 extensions

rule:
  meta:
    name: decrypt data using AES via x86 extensions
    namespace: data-manipulation/encryption/aes
    authors:
      - moritz.raabe@mandiant.com
    scopes:
      static: function
      dynamic: unsupported  # requires mnemonic features
    att&ck:
      - Defense Evasion::Deobfuscate/Decode Files or Information [T1140]
    mbc:
      - Cryptography::Decrypt Data::AES [C0031.001]
    examples:
      - 66602B5FAB602CB4E6F754748D249542:0x4097D0
  features:
    - or:
      - mnemonic: aesdec = Perform One Round of an AES Decryption Flow
      - mnemonic: vaesdec
      - mnemonic: aesdeclast = Perform Last Round of an AES Decryption Flow
      - mnemonic: vaesdeclast