manually build AES constants

rule:
  meta:
    name: manually build AES constants
    namespace: data-manipulation/encryption/aes
    authors:
      - huynh.t.nhan@gmail.com
    scopes:
      static: function
      dynamic: unsupported  # requires characteristic, mnemonic features
    att&ck:
      - Defense Evasion::Obfuscated Files or Information [T1027]
    mbc:
      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
      - Cryptography::Encrypt Data::AES [C0027.001]
    examples:
      - 8333822ed41d9f2b302cf8e21b126efc:0x40646a
      - 5553bbc23dea546192d07f268c4764a9:0x1149
      - 316aad44bb75e0c7676e173bcb56413e:0x11CD
      - 142300d78d9fb083122332235d93d3ae:0x1210
      - e735a3df2b9ac89ca35ae643d3e73cf9:0x1240
      - fbddca0225a3b806d4b4c933c1c4a636:0x140001000
      - 84b777dc2d7083fd983d946f9fe2bf00:0x401000
  features:
    - and:
      - or:
        - count(mnemonic(rol)): 4 or more
        - count(mnemonic(shl)): 4 or more
      - count(number(0x63)): 2
      - number: 0x1B
      - basic block:
        - and:
          - number: 0x63
          - count(characteristic(nzxor)): 5 or more