Add new rule for forwarded exports and update doc to with new charact…

…eristic and examples under export feature

doc/format.md

@@ -314,7 +314,8 @@ For example, the `characteristic: nzxor` feature describes non-zeroing XOR instr
 | characteristic                       | scope                              | description |
 |--------------------------------------|------------------------------------|-------------|
 | `characteristic: embedded pe`        | file                               | (XOR encoded) embedded PE files. |
-| `characteristic: mixed mode` | file | File contains both managed and unmanaged (native) code, often seen in .NET |
+| `characteristic: forwarded export`   | file                               | PE file that forward export. |
+| `characteristic: mixed mode`         | file                               | File contains both managed and unmanaged (native) code, often seen in .NET |
 | `characteristic: loop`               | function                           | Function contains a loop. |
 | `characteristic: recursive call`     | function                           | Function is recursive. |
 | `characteristic: calls from`         | function                           | There are unique calls from this function. Best used like: `count(characteristic(calls from)): 3 or more` |
@@ -328,7 +329,7 @@ For example, the `characteristic: nzxor` feature describes non-zeroing XOR instr
 | `characteristic: cross section flow` | instruction, basic block, function | Function contains a call/jump to a different section. This is commonly seen in unpacking stubs. |
 | `characteristic: indirect call`      | instruction, basic block, function | Indirect call instruction; for example, `call edx` or `call qword ptr [rsp+78h]`. |
 | `characteristic: call $+5`           | instruction, basic block, function | Call just past the current instruction. |
-| `characteristic: unmanaged call` | instruction, basic block, function | Function contains a call from managed code to unmanaged (native) code, often seen in .NET |
+| `characteristic: unmanaged call`     | instruction, basic block, function | Function contains a call from managed code to unmanaged (native) code, often seen in .NET |
 
 ## instruction features
 
@@ -604,6 +605,11 @@ Examples:
 
     export: InstallA
 
+And for forwarded exports:
+
+    export: "c:/windows/system32/version.GetFileVersionInfoA"
+    export: "vresion.GetFileVersionInfoA"
+
 ### import
 
 The name of a routine imported from a shared library.

executable/pe/export/forwarded-export.yml

@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: forwarded export
+    namespace: executable/pe/export
+    authors:
+      - [email protected]
+    scope: file
+    att&ck:
+      - Execution::Shared Modules [T1129]
+    examples:
+      - 76FA734236DAA023444DEC26863401DC:0x18003BD32
+  features:
+    - characteristic: forwarded export