Create encrypt-data-using-rc4-via-systemfunction033.yml (#890)

* Create encrypt-data-using-rc4-via-systemfunction033.yml

Similar to SystemFunction032, this undocumented API allows encryption/decryption using RC4 algo

data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml

@@ -0,0 +1,27 @@
+rule:
+  meta:
+    name: encrypt data using RC4 via SystemFunction033
+    namespace: data-manipulation/encryption/rc4
+    authors:
+      - daniel.stepanic@elastic.co
+    scopes:
+      static: function
+      dynamic: thread
+    att&ck:
+      - Defense Evasion::Obfuscated Files or Information [T1027]
+    mbc:
+      - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
+      - Cryptography::Encrypt Data::RC4 [C0027.009]
+    references:
+      - https://www.redteam.cafe/red-team/shellcode-injection/inmemory-shellcode-encryption-and-decryption-using-systemfunction033
+    examples:
+      - 0f33c2fec223823f84a732ceb1ad94ed2645e896095144850cf1443aeda67da6:0x180001000 # api match
+  features:
+    - or:
+      - api: SystemFunction033
+      - and:
+        - match: link function at runtime on Windows
+        - string: "SystemFunction033"
+        - optional:
+          - string: /advapi32/i
+          - string: /cryptsp/i