From b7555ecb0f4179da3210f44cb6263366c088b2ba Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Wed, 3 Feb 2021 10:26:40 -0700
Subject: [PATCH] Create generate-random-numbers-using-the-delphi-lcg.yml

---
 ...erate-random-numbers-using-the-delphi-lcg.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 nursery/generate-random-numbers-using-the-delphi-lcg.yml

diff --git a/nursery/generate-random-numbers-using-the-delphi-lcg.yml b/nursery/generate-random-numbers-using-the-delphi-lcg.yml
new file mode 100644
index 000000000..353181af1
--- /dev/null
+++ b/nursery/generate-random-numbers-using-the-delphi-lcg.yml
@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: generate random numbers using the Delphi LCG
+    namespace: data-manipulation/prng/lcg
+    author: william.ballenthin@fireeye.com
+    scope: basic block
+    mbc:
+      - Cryptography::Generate Pseudo-random Sequence [C0021]
+    references:
+      - https://en.wikipedia.org/wiki/Linear_congruential_generator
+      - https://community.osr.com/discussion/130410/generating-random-numbers
+  features:
+    - and:
+      - mnemonic: imul
+      - number: 0x8088405 = multiplier a
+      - mnemonic: inc = increment c