Osianoh Glenn Aliu

Year	Rank	Type	Title / Venue / Authors
2018	—	`conf`	LoRa WanEvaluation for IoT Communications. ICACCI Divita Singh, Osianoh Glenn Aliu, Mathias Kretschmer
2016	B	`conf`	Configuration of the Wireless interface for software defined wireless networks. NetSoft Osianoh Glenn Aliu, Christian Niephaus, Mathias Kretschmer
2016	B	`conf`	Wireless backhaul for mobile edge computing. NetSoft Osianoh Glenn Aliu, Christian Niephaus, Mathias Kretschmer
2015	J	`jnl`	A New Cellular-Automata-Based Fractional Frequency Reuse Scheme. IEEE Trans. Veh. Technol. Osianoh Glenn Aliu, Mahima Mehta, Muhammad Ali Imran, Abhay Karandikar, Barry G. Evans
2015	B	`conf`	SDN in the wireless context - Towards full programmability of wireless network elements. NetSoft Christian Niephaus, Gheorghita Ghinea, Osianoh Glenn Aliu, Senka Hadzic, Mathias Kretschmer
2015	—	`conf`	Towards Adoption of Software Defined Wireless Backhaul Networks. IoT 360 (2) Osianoh Glenn Aliu, Senka Hadzic, Christian Niephaus, Mathias Kretschmer
2015	J	`jnl`	Wireless Back-haul: a software defined network enabled wireless Back-haul network architecture for future 5G networks. IET Networks Christian Niephaus, Osianoh Glenn Aliu, Mathias Kretschmer, Senka Hadzic, Gheorghita Ghinea
2014	—	`conf`	5G resilient backhaul using integrated satellite networks. ASMS/SPSC Simon Watts, Osianoh Glenn Aliu
2014	—	`conf`	Business interoperability framework for integrated terrestrial-satellite network. ASMS/SPSC Osianoh Glenn Aliu, Simon Watts, Adam Kapvotivs
2014	—	`conf`	Towards Centralized Spectrum Allocation Optimization for Multi-Channel Wireless Backhauls. AFRICOMM Michael Rademacher, Senka Hadzic, Philipp Batroff, Osianoh Glenn Aliu, Mathias Kretschmer
2013	—	`conf`	A Cellular Automata Approach towards Self Organisation in Wireless Cellular Networks. EW Osianoh Glenn Aliu, Mahima Mehta, Barry G. Evans
2013	J	`jnl`	A Survey of Self Organisation in Future Cellular Networks. IEEE Commun. Surv. Tutorials Osianoh Glenn Aliu, Ali Imran, Muhammad Ali Imran, Barry G. Evans
2013	J	`jnl`	Advances in base- and mobile-station aided cooperative wireless communications: An overview. IEEE Veh. Technol. Mag. Rong Zhang, Li Wang, Gerard Parr, Osianoh Glenn Aliu, Benga Awoseyila, Nader Azarmi, Saleem Bhatti, Eliane L. Bodanese, Hong Chen, Mehrdad Dianati, Amit Kumar Dutta, Michael Fitch, Krishnamurthy Giridhar, Steve Hailes, K. V. S. Hari, Muhammad Ali Imran, Aditya K. Jagannatham, Abhay Karandikar, Santosh Kawade, Mohammed Zafar Ali Khan, Sayee C. Kompalli, Patrick Langdon, Babu Narayanan, Andreas Mauthe, Joseph McGeehan, Neelesh B. Mehta, J. Klutto Milleth, Klaus Moessner, Rakshith Rajashekar, Barathram Ramkumar, Vinay J. Ribeiro, Kasturi Vasudevan, Lajos Hanzo, John Bigham
2013	—	`conf`	Unified Solution Towards Deployment of TV White Space in Africa. AFRICOMM Philipp Batroff, Osianoh Glenn Aliu, Eric Schütz, Mathias Kretschmer, Christian Niephaus, Karl Jonas
2012	B	`conf`	Controlling self healing cellular networks using fuzzy logic. WCNC Arsalan Saeed, Osianoh Glenn Aliu, Muhammad Ali Imran
2011	J	`jnl`	A Self-Organized Resource Allocation using Inter-Cell Interference Coordination (ICIC) in Relay-Assisted Cellular Networks CoRR Mahima Mehta, Osianoh Glenn Aliu, Abhay Karandikar, Muhammad Ali Imran
2011	B	`conf`	Hybrid spectrum allocation scheme in wireless cellular networks. IWCMC Rejoy George, Osianoh Glenn Aliu, Muhammad Ali Imran
{
    "meta": {
        "timestamp": "2024-08-28T11:33:45.272566",
        "version": "7.2.0",
        "argv": [
            "-j",
            "/mnt/samples/consilience/malware/test/test-unzipped/d8637bdbcfc9112fcb1f0167b398e771"
        ],
        "sample": {
            "md5": "d8637bdbcfc9112fcb1f0167b398e771",
            "sha1": "3135ba4f32052528bb0c8909fc2f954699d4a8fd",
            "sha256": "09f7d02a3c2382199458c98a62b045145ee54ab6aba86166aecf3d10c3c1444c",
            "path": "/mnt/samples/consilience/malware/test/test-unzipped/d8637bdbcfc9112fcb1f0167b398e771"
        },
        "flavor": "static",
        "analysis": {
            "format": "dotnet",
            "arch": "i386",
            "os": "any",
            "extractor": "DnfileFeatureExtractor",
            "rules": [
                "/tmp/_MEI5OemLT/rules"
            ],
            "base_address": {
                "type": "no address"
            },
            "layout": {
                "functions": [
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663319
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663319
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663323
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663323
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663324
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663324
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663325
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663325
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663352
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663352
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663356
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663356
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663357
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663357
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663358
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663358
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663359
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663359
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663360
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663360
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663362
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663362
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663363
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663363
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663366
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663366
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663367
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663367
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663379
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663379
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663380
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663380
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663381
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663381
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663383
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663383
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663385
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663385
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663393
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663393
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663395
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663395
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663397
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663397
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663400
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663400
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663412
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663412
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663414
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663414
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663420
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663420
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663422
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663422
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663423
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663423
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663430
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663430
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663431
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663431
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663432
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663432
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663434
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663434
                                }
                            }
                        ]
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663454
                        },
                        "matched_basic_blocks": [
                            {
                                "address": {
                                    "type": "dn token",
                                    "value": 100663454
                                }
                            }
                        ]
                    }
                ]
            },
            "feature_counts": {
                "file": 1913,
                "functions": [
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663297
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663298
                        },
                        "count": 26
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663299
                        },
                        "count": 47
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663300
                        },
                        "count": 11
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663301
                        },
                        "count": 32
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663302
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663303
                        },
                        "count": 52
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663304
                        },
                        "count": 9
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663305
                        },
                        "count": 17
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663306
                        },
                        "count": 23
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663307
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663308
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663309
                        },
                        "count": 18
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663310
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663311
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663312
                        },
                        "count": 9
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663313
                        },
                        "count": 13
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663314
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663315
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663316
                        },
                        "count": 12
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663317
                        },
                        "count": 52
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663318
                        },
                        "count": 35
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663319
                        },
                        "count": 75
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663320
                        },
                        "count": 11
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663323
                        },
                        "count": 15
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663324
                        },
                        "count": 31
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663325
                        },
                        "count": 17
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663326
                        },
                        "count": 40
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663327
                        },
                        "count": 19
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663328
                        },
                        "count": 42
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663329
                        },
                        "count": 9
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663330
                        },
                        "count": 17
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663341
                        },
                        "count": 18
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663342
                        },
                        "count": 18
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663343
                        },
                        "count": 15
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663344
                        },
                        "count": 12
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663345
                        },
                        "count": 38
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663346
                        },
                        "count": 35
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663347
                        },
                        "count": 39
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663348
                        },
                        "count": 40
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663349
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663350
                        },
                        "count": 35
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663351
                        },
                        "count": 33
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663352
                        },
                        "count": 31
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663353
                        },
                        "count": 26
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663354
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663355
                        },
                        "count": 29
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663356
                        },
                        "count": 25
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663357
                        },
                        "count": 21
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663358
                        },
                        "count": 118
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663359
                        },
                        "count": 48
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663360
                        },
                        "count": 23
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663361
                        },
                        "count": 55
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663362
                        },
                        "count": 45
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663363
                        },
                        "count": 44
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663364
                        },
                        "count": 39
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663365
                        },
                        "count": 31
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663366
                        },
                        "count": 41
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663367
                        },
                        "count": 64
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663368
                        },
                        "count": 25
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663369
                        },
                        "count": 41
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663370
                        },
                        "count": 111
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663371
                        },
                        "count": 43
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663372
                        },
                        "count": 43
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663373
                        },
                        "count": 25
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663374
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663375
                        },
                        "count": 17
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663376
                        },
                        "count": 35
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663377
                        },
                        "count": 32
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663378
                        },
                        "count": 37
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663379
                        },
                        "count": 33
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663380
                        },
                        "count": 194
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663381
                        },
                        "count": 56
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663382
                        },
                        "count": 33
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663383
                        },
                        "count": 37
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663384
                        },
                        "count": 29
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663385
                        },
                        "count": 31
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663386
                        },
                        "count": 42
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663387
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663388
                        },
                        "count": 24
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663389
                        },
                        "count": 22
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663390
                        },
                        "count": 20
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663391
                        },
                        "count": 32
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663392
                        },
                        "count": 32
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663393
                        },
                        "count": 49
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663394
                        },
                        "count": 30
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663395
                        },
                        "count": 38
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663396
                        },
                        "count": 21
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663397
                        },
                        "count": 74
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663398
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663399
                        },
                        "count": 30
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663400
                        },
                        "count": 31
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663401
                        },
                        "count": 116
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663402
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663403
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663404
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663405
                        },
                        "count": 9
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663406
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663407
                        },
                        "count": 24
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663408
                        },
                        "count": 20
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663409
                        },
                        "count": 29
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663410
                        },
                        "count": 59
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663411
                        },
                        "count": 43
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663412
                        },
                        "count": 69
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663413
                        },
                        "count": 35
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663414
                        },
                        "count": 38
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663415
                        },
                        "count": 27
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663416
                        },
                        "count": 37
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663417
                        },
                        "count": 9
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663418
                        },
                        "count": 39
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663419
                        },
                        "count": 23
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663420
                        },
                        "count": 36
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663421
                        },
                        "count": 32
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663422
                        },
                        "count": 23
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663423
                        },
                        "count": 32
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663424
                        },
                        "count": 9
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663425
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663426
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663427
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663428
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663429
                        },
                        "count": 39
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663430
                        },
                        "count": 23
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663431
                        },
                        "count": 25
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663432
                        },
                        "count": 27
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663433
                        },
                        "count": 11
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663434
                        },
                        "count": 28
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663435
                        },
                        "count": 53
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663436
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663437
                        },
                        "count": 23
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663438
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663439
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663440
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663441
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663442
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663443
                        },
                        "count": 9
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663444
                        },
                        "count": 13
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663445
                        },
                        "count": 30
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663446
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663447
                        },
                        "count": 45
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663448
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663449
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663450
                        },
                        "count": 4
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663451
                        },
                        "count": 8
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663452
                        },
                        "count": 21
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663453
                        },
                        "count": 9
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663454
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663455
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663456
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663457
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663458
                        },
                        "count": 16
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663459
                        },
                        "count": 17
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663460
                        },
                        "count": 17
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663461
                        },
                        "count": 15
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663462
                        },
                        "count": 14
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663463
                        },
                        "count": 17
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663464
                        },
                        "count": 17
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663465
                        },
                        "count": 15
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663466
                        },
                        "count": 17
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663467
                        },
                        "count": 19
                    },
                    {
                        "address": {
                            "type": "dn token",
                            "value": 100663468
                        },
                        "count": 19
                    }
                ]
            },
            "library_functions": []
        }
    },
    "rules": {
        "create or open registry key": {
            "meta": {
                "name": "create or open registry key",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "basic block",
                    "dynamic": "call"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "Operating System",
                            "Registry",
                            "Create Registry Key"
                        ],
                        "objective": "Operating System",
                        "behavior": "Registry",
                        "method": "Create Registry Key",
                        "id": "C0036.004"
                    },
                    {
                        "parts": [
                            "Operating System",
                            "Registry",
                            "Open Registry Key"
                        ],
                        "objective": "Operating System",
                        "behavior": "Registry",
                        "method": "Open Registry Key",
                        "id": "C0036.003"
                    }
                ],
                "references": [],
                "examples": [
                    "Practical Malware Analysis Lab 03-02.dll_:0x10004706",
                    "Practical Malware Analysis Lab 11-01.exe_:0x401000",
                    "493167E85E45363D09495D0841C30648:0x404D60",
                    "B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2",
                    "B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E",
                    "692f7fd6d198e804d6af98eb9e390d61:0x6000003"
                ],
                "description": "",
                "lib": true,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: create or open registry key\n    authors:\n      - [email protected]\n      - [email protected]\n    lib: true\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Operating System::Registry::Create Registry Key [C0036.004]\n      - Operating System::Registry::Open Registry Key [C0036.003]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10004706\n      - Practical Malware Analysis Lab 11-01.exe_:0x401000\n      - 493167E85E45363D09495D0841C30648:0x404D60\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: advapi32.RegOpenKey\n      - api: advapi32.RegOpenKeyEx\n      - api: advapi32.RegCreateKey\n      - api: advapi32.RegCreateKeyEx\n      - api: advapi32.RegOpenCurrentUser\n      - api: advapi32.RegOpenKeyTransacted\n      - api: advapi32.RegOpenUserClassesRoot\n      - api: advapi32.RegCreateKeyTransacted\n      - api: ZwOpenKey\n      - api: ZwOpenKeyEx\n      - api: ZwCreateKey\n      - api: ZwOpenKeyTransacted\n      - api: ZwOpenKeyTransactedEx\n      - api: ZwCreateKeyTransacted\n      - api: NtOpenKey\n      - api: NtCreateKey\n      - api: SHRegOpenUSKey\n      - api: SHRegCreateUSKey\n      - api: RtlCreateRegistryKey\n      - api: Microsoft.Win32.RegistryKey::OpenSubKey\n      - api: Microsoft.Win32.RegistryKey::OpenBaseKey\n      - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\n      - api: Microsoft.Win32.RegistryKey::CreateSubKey\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenCurrentUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenUserClassesRoot"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransactedEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegOpenUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegCreateUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateRegistryKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663319,
                                            315
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663356
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenCurrentUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenUserClassesRoot"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransactedEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegOpenUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegCreateUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateRegistryKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663356,
                                            13
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663356,
                                            84
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663357
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenCurrentUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenUserClassesRoot"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransactedEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegOpenUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegCreateUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateRegistryKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663357,
                                            20
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663357,
                                            61
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663381
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenCurrentUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenUserClassesRoot"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransactedEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegOpenUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegCreateUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateRegistryKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            555
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663431
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenCurrentUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenUserClassesRoot"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransactedEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegOpenUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegCreateUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateRegistryKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663431,
                                            56
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663432
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenCurrentUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenUserClassesRoot"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransactedEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegOpenUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegCreateUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateRegistryKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663432,
                                            35
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663434
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenCurrentUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegOpenUserClassesRoot"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RegCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwOpenKeyTransactedEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateKeyTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtOpenKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegOpenUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHRegCreateUSKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateRegistryKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663434,
                                            35
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "suspend thread": {
            "meta": {
                "name": "suspend thread",
                "namespace": "host-interaction/thread/suspend",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "basic block",
                    "dynamic": "call"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "Process",
                            "Suspend Thread"
                        ],
                        "objective": "Process",
                        "behavior": "Suspend Thread",
                        "method": "",
                        "id": "C0055"
                    }
                ],
                "references": [],
                "examples": [
                    "787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x502f4c"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: suspend thread\n    namespace: host-interaction/thread/suspend\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Suspend Thread [C0055]\n    examples:\n      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x502f4c\n  features:\n    - or:\n      - api: kernel32.SuspendThread\n      - api: ntdll.NtSuspendThread\n      - api: ntdll.ZwSuspendThread\n      - api: System.Threading.Thread::Suspend\n      - api: System.Threading.Thread::Sleep\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Suspend"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Sleep"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663319,
                                            172
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663324
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Suspend"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Sleep"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663324,
                                            55
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663362
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Suspend"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Sleep"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663362,
                                            67
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663366
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Suspend"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Sleep"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663366,
                                            71
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663400
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwSuspendThread"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Suspend"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Thread::Sleep"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663400,
                                            17
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "set file attributes": {
            "meta": {
                "name": "set file attributes",
                "namespace": "host-interaction/file-system/meta",
                "authors": [
                    "[email protected]",
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "basic block",
                    "dynamic": "call"
                },
                "attack": [
                    {
                        "parts": [
                            "Defense Evasion",
                            "File and Directory Permissions Modification"
                        ],
                        "tactic": "Defense Evasion",
                        "technique": "File and Directory Permissions Modification",
                        "subtechnique": "",
                        "id": "T1222"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "File System",
                            "Set File Attributes"
                        ],
                        "objective": "File System",
                        "behavior": "Set File Attributes",
                        "method": "",
                        "id": "C0050"
                    }
                ],
                "references": [],
                "examples": [
                    "946A99F36A46D335DEC080D9A4371940:0x100015f0",
                    "B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: set file attributes\n    namespace: host-interaction/file-system/meta\n    authors:\n      - [email protected]\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: basic block\n      dynamic: call\n    att&ck:\n      - Defense Evasion::File and Directory Permissions Modification [T1222]\n    mbc:\n      - File System::Set File Attributes [C0050]\n    examples:\n      - 946A99F36A46D335DEC080D9A4371940:0x100015f0\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6\n  features:\n    - or:\n      - api: kernel32.SetFileAttributes\n      - api: ZwSetInformationFile\n      - api: NtSetInformationFile\n      - api: System.IO.File::SetAttributes\n      - api: System.IO.File::SetCreationTime\n      - api: System.IO.File::SetCreationTimeUtc\n      - api: System.IO.File::SetLastAccessTime\n      - api: System.IO.File::SetLastAccessTimeUtc\n      - api: System.IO.File::SetLastWriteTime\n      - api: System.IO.File::SetLastWriteTimeUtc\n      - property/write: System.IO.FileSystemInfo::Attributes\n      - api: utime\n      - api: utimes\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663352
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SetFileAttributes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwSetInformationFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtSetInformationFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetAttributes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663352,
                                            59
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetCreationTime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetCreationTimeUtc"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetLastAccessTime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetLastAccessTimeUtc"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetLastWriteTime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetLastWriteTimeUtc"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "write",
                                        "property": "System.IO.FileSystemInfo::Attributes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "utime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "utimes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663423
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SetFileAttributes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwSetInformationFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtSetInformationFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetAttributes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663423,
                                            169
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetCreationTime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetCreationTimeUtc"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetLastAccessTime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetLastAccessTimeUtc"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetLastWriteTime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::SetLastWriteTimeUtc"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "write",
                                        "property": "System.IO.FileSystemInfo::Attributes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "utime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "utimes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "get OS version in .NET": {
            "meta": {
                "name": "get OS version in .NET",
                "namespace": "host-interaction/os/version",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "basic block"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "System Information Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "System Information Discovery",
                        "subtechnique": "",
                        "id": "T1082"
                    }
                ],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: get OS version in .NET\n    namespace: host-interaction/os/version\n    authors:\n      - [email protected]\n    scopes:\n      static: basic block\n      dynamic: unsupported  # requires property features\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n  features:\n    - or:\n      - property/read: System.Environment::OSVersion\n      - property/read: System.Environment::Is64BitOperatingSystem\n      - property/read: System.OperatingSystem::Version\n      - property/read: Microsoft.VisualBasic.Devices.ComputerInfo::OSFullName\n      - property/read: System.Runtime.InteropServices.RuntimeInformation::OSDescription\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663359
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::OSVersion"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663359,
                                            1
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::Is64BitOperatingSystem"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.OperatingSystem::Version"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663359,
                                            14
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "Microsoft.VisualBasic.Devices.ComputerInfo::OSFullName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Runtime.InteropServices.RuntimeInformation::OSDescription"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "create thread": {
            "meta": {
                "name": "create thread",
                "namespace": "host-interaction/thread/create",
                "authors": [
                    "[email protected]",
                    "[email protected]",
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "basic block",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "Process",
                            "Create Thread"
                        ],
                        "objective": "Process",
                        "behavior": "Create Thread",
                        "method": "",
                        "id": "C0038"
                    }
                ],
                "references": [],
                "examples": [
                    "946A99F36A46D335DEC080D9A4371940:0x10001DA0",
                    "B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: create thread\n    namespace: host-interaction/thread/create\n    authors:\n      - [email protected]\n      - [email protected]\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: basic block\n      dynamic: thread\n    mbc:\n      - Process::Create Thread [C0038]\n    examples:\n      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x408020\n  features:\n    - or:\n      - and:\n        - os: windows\n        - or:\n          - api: kernel32.CreateThread\n          - api: _beginthread\n          - api: _beginthreadex\n          - api: PsCreateSystemThread\n          - api: SHCreateThread\n          - api: SHCreateThreadWithHandle\n          - api: kernel32.CreateRemoteThread\n          - api: kernel32.CreateRemoteThreadEx\n          - api: RtlCreateUserThread\n          - api: ntdll.NtCreateThread\n          - api: ntdll.NtCreateThreadEx\n          - api: ntdll.ZwCreateThread\n          - api: ntdll.ZwCreateThreadEx\n      - and:\n        - or:\n          - os: linux\n          - os: android\n        - api: pthread_create\n      - and:\n        - api: System.Threading.Thread::Start\n        - optional:\n          - api: System.Threading.Thread::ctor\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663379
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "os",
                                                        "os": "linux"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "no address"
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "os",
                                                        "os": "android"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "no address"
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "pthread_create"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Threading.Thread::Start"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663379,
                                                    105
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "System.Threading.Thread::ctor"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663379,
                                                            89
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663379,
                                                            67
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_beginthread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_beginthreadex"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "PsCreateSystemThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHCreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHCreateThreadWithHandle"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateRemoteThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateRemoteThreadEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RtlCreateUserThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtCreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtCreateThreadEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwCreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwCreateThreadEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663380
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "os",
                                                        "os": "linux"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "no address"
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "os",
                                                        "os": "android"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "no address"
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "pthread_create"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Threading.Thread::Start"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    1672
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    1803
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    3310
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    1269
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    2190
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    3180
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    1592
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    3044
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    3221
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    1366
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    1970
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    2089
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    2664
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    2580
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    3390
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    2943
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    1178
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    2496
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    1512
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    2412
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    2859
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663380,
                                                    2328
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "System.Threading.Thread::ctor"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            3028
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            2073
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            3205
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            1350
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            1954
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            2648
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            2564
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            3374
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            2927
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            2843
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            1162
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            2480
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            1496
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            2396
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            1656
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            2312
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            1787
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            3164
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            3294
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            1253
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            1576
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663380,
                                                            2174
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_beginthread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_beginthreadex"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "PsCreateSystemThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHCreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHCreateThreadWithHandle"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateRemoteThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateRemoteThreadEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RtlCreateUserThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtCreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtCreateThreadEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwCreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwCreateThreadEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663420
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "os",
                                                        "os": "linux"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "no address"
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "os",
                                                        "os": "android"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "no address"
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "pthread_create"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Threading.Thread::Start"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663420,
                                                    96
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "System.Threading.Thread::ctor"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663420,
                                                            80
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_beginthread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_beginthreadex"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "PsCreateSystemThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHCreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHCreateThreadWithHandle"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateRemoteThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateRemoteThreadEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RtlCreateUserThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtCreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtCreateThreadEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwCreateThread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwCreateThreadEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "create process on Windows": {
            "meta": {
                "name": "create process on Windows",
                "namespace": "host-interaction/process/create",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "basic block",
                    "dynamic": "call"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "Process",
                            "Create Process"
                        ],
                        "objective": "Process",
                        "behavior": "Create Process",
                        "method": "",
                        "id": "C0017"
                    }
                ],
                "references": [],
                "examples": [
                    "9324D1A8AE37A36AE560C37448C9705A:0x406DB0",
                    "Practical Malware Analysis Lab 01-04.exe_:0x4011FC",
                    "692f7fd6d198e804d6af98eb9e390d61:0x6000003"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: create process on Windows\n    namespace: host-interaction/process/create\n    authors:\n      - [email protected]\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - Process::Create Process [C0017]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x406DB0\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: kernel32.WinExec\n      - api: kernel32.CreateProcess\n      - api: shell32.ShellExecute\n      - api: shell32.ShellExecuteEx\n      - api: advapi32.CreateProcessAsUser\n      - api: advapi32.CreateProcessWithLogon\n      - api: advapi32.CreateProcessWithToken\n      - api: kernel32.CreateProcessInternal\n      - api: ntdll.NtCreateUserProcess\n      - api: ntdll.NtCreateProcess\n      - api: ntdll.NtCreateProcessEx\n      - api: ntdll.ZwCreateProcess\n      - api: ZwCreateProcessEx\n      - api: ntdll.ZwCreateUserProcess\n      - api: ntdll.RtlCreateUserProcess\n      - api: System.Diagnostics.Process::Start\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663383
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "WinExec"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ShellExecute"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ShellExecuteEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessAsUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessWithLogon"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessWithToken"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessInternal"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateUserProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateProcessEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateProcessEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateUserProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateUserProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::Start"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663383,
                                            86
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663395
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "WinExec"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ShellExecute"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ShellExecuteEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessAsUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessWithLogon"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessWithToken"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessInternal"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateUserProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateProcessEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateProcessEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateUserProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateUserProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::Start"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663395,
                                            84
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663422
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "WinExec"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ShellExecute"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ShellExecuteEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessAsUser"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessWithLogon"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessWithToken"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateProcessInternal"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateUserProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateProcessEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateProcessEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateUserProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "RtlCreateUserProcess"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::Start"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663422,
                                            36
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "get file attributes": {
            "meta": {
                "name": "get file attributes",
                "namespace": "host-interaction/file-system/meta",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "basic block",
                    "dynamic": "call"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "File System",
                            "Get File Attributes"
                        ],
                        "objective": "File System",
                        "behavior": "Get File Attributes",
                        "method": "",
                        "id": "C0049"
                    }
                ],
                "references": [],
                "examples": [
                    "03B236B23B1EC37C663527C1F53AF3FE:0x180019824",
                    "B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6",
                    "B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: get file attributes\n    namespace: host-interaction/file-system/meta\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: basic block\n      dynamic: call\n    mbc:\n      - File System::Get File Attributes [C0049]\n    examples:\n      - 03B236B23B1EC37C663527C1F53AF3FE:0x180019824\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0\n  features:\n    - or:\n      - api: kernel32.GetFileAttributes\n      - api: ZwQueryDirectoryFile\n      - api: ZwQueryInformationFile\n      - api: NtQueryDirectoryFile\n      - api: NtQueryInformationFile\n      - api: System.IO.File::GetAttributes\n      - api: System.IO.File::GetCreationTime\n      - api: System.IO.File::GetCreationTimeUtc\n      - api: System.IO.File::GetLastAccessTime\n      - api: System.IO.File::GetLastAccessTimeUtc\n      - api: System.IO.File::GetLastWriteTime\n      - api: System.IO.File::GetLastWriteTimeUtc\n      - property/read: System.IO.FileSystemInfo::Attributes\n      - api: stat\n      - api: fstat\n      - api: lstat\n      - api: fstatat\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663393
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetFileAttributes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwQueryDirectoryFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwQueryInformationFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtQueryDirectoryFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtQueryInformationFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::GetAttributes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::GetCreationTime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::GetCreationTimeUtc"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::GetLastAccessTime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::GetLastAccessTimeUtc"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::GetLastWriteTime"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::GetLastWriteTimeUtc"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663393,
                                            112
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Attributes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "stat"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "fstat"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "lstat"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "fstatat"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "execute via timer in .NET": {
            "meta": {
                "name": "execute via timer in .NET",
                "namespace": "host-interaction/thread/timer",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: execute via timer in .NET\n    namespace: host-interaction/thread/timer\n    authors:\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n  features:\n    - or:\n      - api: System.Threading.Timer::ctor\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663299
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Timer::ctor"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663299,
                                            136
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663373
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Threading.Timer::ctor"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663373,
                                            43
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "enumerate processes": {
            "meta": {
                "name": "enumerate processes",
                "namespace": "host-interaction/process/list",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "Process Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "Process Discovery",
                        "subtechnique": "",
                        "id": "T1057"
                    },
                    {
                        "parts": [
                            "Discovery",
                            "Software Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "Software Discovery",
                        "subtechnique": "",
                        "id": "T1518"
                    }
                ],
                "mbc": [],
                "references": [],
                "examples": [
                    "2D3EDC218A90F03089CC01715A9F047F:0x403DAB",
                    "35d04ecd797041eee796f4ddaa96cae8:0x10004F34"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: enumerate processes\n    namespace: host-interaction/process/list\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n      - Discovery::Software Discovery [T1518]\n    examples:\n      - 2D3EDC218A90F03089CC01715A9F047F:0x403DAB\n      - 35d04ecd797041eee796f4ddaa96cae8:0x10004F34\n  features:\n    - or:\n      - api: System.Diagnostics.Process::GetProcesses\n      - and:\n        - api: kernel32.Process32First\n        - api: kernel32.Process32Next\n        - optional:\n          - basic block:\n            - and:\n              - or:\n                - number: 0xF = TH32CS_SNAPALL\n                - number: 0x2 = TH32CS_SNAPPROCESS\n              - api: kernel32.CreateToolhelp32Snapshot\n          - call:\n            - and:\n              - or:\n                - number: 0xF = TH32CS_SNAPALL\n                - number: 0x2 = TH32CS_SNAPPROCESS\n              - api: kernel32.CreateToolhelp32Snapshot\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663301
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::GetProcesses"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663301,
                                            2
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Process32First"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Process32Next"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "enumerate processes/1c5c3a1d7fcd4f37832f34955f201878"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "enumerate processes/7bd6755bf1c74c29aec945b2fdf833e8"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663358
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::GetProcesses"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663358,
                                            4
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Process32First"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Process32Next"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "enumerate processes/1c5c3a1d7fcd4f37832f34955f201878"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "enumerate processes/7bd6755bf1c74c29aec945b2fdf833e8"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663367
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::GetProcesses"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663367,
                                            8
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Process32First"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Process32Next"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "enumerate processes/1c5c3a1d7fcd4f37832f34955f201878"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "enumerate processes/7bd6755bf1c74c29aec945b2fdf833e8"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663412
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::GetProcesses"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663412,
                                            4
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Process32First"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Process32Next"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "enumerate processes/1c5c3a1d7fcd4f37832f34955f201878"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "enumerate processes/7bd6755bf1c74c29aec945b2fdf833e8"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "access .NET resource": {
            "meta": {
                "name": "access .NET resource",
                "namespace": "executable/resource",
                "authors": [
                    "@mr-tz"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [],
                "references": [],
                "examples": [
                    "387f15043f0198fd3a637b0758c2b6dde9ead795c3ed70803426fc355731b173:0x06000084"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: access .NET resource\n    namespace: executable/resource\n    authors:\n      - \"@mr-tz\"\n    scopes:\n      static: function\n      dynamic: thread\n    examples:\n      - 387f15043f0198fd3a637b0758c2b6dde9ead795c3ed70803426fc355731b173:0x06000084\n  features:\n    - and:\n      - format: dotnet\n      - or:\n        - api: System.Resources.ResourceManager::ctor\n        - api: System.Reflection.Assembly::GetManifestResourceStream\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663306
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "format",
                                        "format": "dotnet"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "no address"
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Resources.ResourceManager::ctor"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663306,
                                                    40
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Reflection.Assembly::GetManifestResourceStream"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663437
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "format",
                                        "format": "dotnet"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "no address"
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Resources.ResourceManager::ctor"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663437,
                                                    40
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Reflection.Assembly::GetManifestResourceStream"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "get common file path": {
            "meta": {
                "name": "get common file path",
                "namespace": "host-interaction/file-system",
                "authors": [
                    "[email protected]",
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "File and Directory Discovery",
                        "subtechnique": "",
                        "id": "T1083"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "objective": "Discovery",
                        "behavior": "File and Directory Discovery",
                        "method": "",
                        "id": "E1083"
                    }
                ],
                "references": [],
                "examples": [
                    "Practical Malware Analysis Lab 03-02.dll_:0x10003415",
                    "972B219F18379907A045431303F4DA7D:0x404887"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: get common file path\n    namespace: host-interaction/file-system\n    authors:\n      - [email protected]\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - Practical Malware Analysis Lab 03-02.dll_:0x10003415\n      - 972B219F18379907A045431303F4DA7D:0x404887\n  features:\n    - or:\n      - api: kernel32.GetTempPath\n      - api: kernel32.GetTempFileName\n      - api: kernel32.GetSystemDirectory\n      - api: kernel32.GetWindowsDirectory\n      - api: kernel32.GetSystemWow64Directory\n      - api: GetAllUsersProfileDirectory\n      - api: GetAppContainerFolderPath\n      - api: GetCurrentDirectory\n      - api: GetDefaultUserProfileDirectory\n      - api: GetProfilesDirectory\n      - api: GetUserProfileDirectory\n      - api: SHGetFolderPathAndSubDir\n      - api: shell32.SHGetFolderPath\n      - api: shell32.SHGetFolderLocation\n      - api: shell32.SHGetKnownFolderPath\n      - api: shell32.SHGetSpecialFolderPath\n      - api: shell32.SHGetSpecialFolderLocation\n      - api: System.IO.Directory::GetCurrentDirectory\n      - api: System.Environment::GetFolderPath\n      - property/read: System.Environment::SystemDirectory\n      - property/read: System.Environment::CurrentDirectory\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663318
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempFileName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetWindowsDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemWow64Directory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAllUsersProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAppContainerFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetDefaultUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetProfilesDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPathAndSubDir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetKnownFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Environment::GetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663318,
                                            43
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::SystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::CurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663401
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempFileName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetWindowsDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemWow64Directory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAllUsersProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAppContainerFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetDefaultUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetProfilesDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPathAndSubDir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetKnownFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Environment::GetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663401,
                                            281
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663401,
                                            204
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::SystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::CurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663426
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempFileName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetWindowsDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemWow64Directory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAllUsersProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAppContainerFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetDefaultUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetProfilesDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPathAndSubDir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetKnownFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Environment::GetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663426,
                                            3
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::SystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::CurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663427
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempFileName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetWindowsDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemWow64Directory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAllUsersProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAppContainerFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetDefaultUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetProfilesDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPathAndSubDir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetKnownFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Environment::GetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663427,
                                            2
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::SystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::CurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663428
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetTempFileName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetWindowsDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetSystemWow64Directory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAllUsersProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetAppContainerFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetDefaultUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetProfilesDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetUserProfileDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPathAndSubDir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetKnownFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHGetSpecialFolderLocation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetCurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Environment::GetFolderPath"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663428,
                                            3
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::SystemDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::CurrentDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "set registry value": {
            "meta": {
                "name": "set registry value",
                "namespace": "host-interaction/registry/create",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "Operating System",
                            "Registry",
                            "Set Registry Key"
                        ],
                        "objective": "Operating System",
                        "behavior": "Registry",
                        "method": "Set Registry Key",
                        "id": "C0036.001"
                    }
                ],
                "references": [],
                "examples": [
                    "BFB9B5391A13D0AFD787E87AB90F14F5:0x13147AF0",
                    "B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E",
                    "B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40415E",
                    "98c37c3c23bbfb362dac7754c6ba48e75cf24d73bc963a4cdfca557b9e016909:0x40294D"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: set registry value\n    namespace: host-interaction/registry/create\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Operating System::Registry::Set Registry Key [C0036.001]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13147AF0\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40415E\n      - 98c37c3c23bbfb362dac7754c6ba48e75cf24d73bc963a4cdfca557b9e016909:0x40294D\n  features:\n    - or:\n      - and:\n        - optional:\n          - match: create or open registry key\n        - or:\n          - api: advapi32.RegSetValue\n          - api: advapi32.RegSetValueEx\n          - api: advapi32.RegSetKeyValue\n          - api: ZwSetValueKey\n          - api: NtSetValueKey\n          - api: RtlWriteRegistryValue\n          - api: SHSetValue\n          - api: SHRegSetPath\n          - api: SHRegSetValue\n          - api: SHRegSetUSValue\n          - api: SHRegWriteUSValue\n          - api: Microsoft.Win32.RegistryKey::SetValue\n          - api: Microsoft.Win32.Registry::SetValue\n      - and:\n        - match: host-interaction/process/create\n        - string: \"/add/i\"\n        - or:\n          - string: \"/reg(|.exe)/i\"\n          - string: \"/hklm/i\"\n          - string: \"/HKEY_LOCAL_MACHINE/i\"\n          - string: \"/hkcu/i\"\n          - string: \"/HKEY_CURRENT_USER/i\"\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "host-interaction/process/create"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/add/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/reg(|.exe)/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hklm/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_LOCAL_MACHINE/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hkcu/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_CURRENT_USER/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "create or open registry key"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "or"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenCurrentUser"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenUserClassesRoot"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransactedEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegOpenUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegCreateUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RtlCreateRegistryKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [
                                                                    {
                                                                        "type": "dn token offset",
                                                                        "value": [
                                                                            100663319,
                                                                            315
                                                                        ]
                                                                    }
                                                                ],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [
                                                    {
                                                        "type": "dn token",
                                                        "value": 100663319
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValueEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetKeyValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RtlWriteRegistryValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetPath"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegWriteUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.RegistryKey::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663319,
                                                            358
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.Registry::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663357
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "host-interaction/process/create"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/add/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/reg(|.exe)/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hklm/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_LOCAL_MACHINE/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hkcu/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_CURRENT_USER/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "create or open registry key"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "or"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenCurrentUser"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenUserClassesRoot"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransactedEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegOpenUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegCreateUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RtlCreateRegistryKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [
                                                                    {
                                                                        "type": "dn token offset",
                                                                        "value": [
                                                                            100663357,
                                                                            20
                                                                        ]
                                                                    }
                                                                ],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [
                                                                    {
                                                                        "type": "dn token offset",
                                                                        "value": [
                                                                            100663357,
                                                                            61
                                                                        ]
                                                                    }
                                                                ],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [
                                                    {
                                                        "type": "dn token",
                                                        "value": 100663357
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValueEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetKeyValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RtlWriteRegistryValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetPath"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegWriteUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.RegistryKey::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663357,
                                                            39
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663357,
                                                            80
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.Registry::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663381
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "host-interaction/process/create"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/add/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/reg(|.exe)/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hklm/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_LOCAL_MACHINE/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hkcu/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_CURRENT_USER/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "create or open registry key"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "or"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenCurrentUser"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenUserClassesRoot"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransactedEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegOpenUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegCreateUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RtlCreateRegistryKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [
                                                                    {
                                                                        "type": "dn token offset",
                                                                        "value": [
                                                                            100663381,
                                                                            555
                                                                        ]
                                                                    }
                                                                ],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [
                                                    {
                                                        "type": "dn token",
                                                        "value": 100663381
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValueEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetKeyValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RtlWriteRegistryValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetPath"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegWriteUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.RegistryKey::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663381,
                                                            594
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.Registry::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663431
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "host-interaction/process/create"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/add/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/reg(|.exe)/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hklm/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_LOCAL_MACHINE/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hkcu/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_CURRENT_USER/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "create or open registry key"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "or"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenCurrentUser"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenUserClassesRoot"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransactedEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegOpenUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegCreateUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RtlCreateRegistryKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [
                                                                    {
                                                                        "type": "dn token offset",
                                                                        "value": [
                                                                            100663431,
                                                                            56
                                                                        ]
                                                                    }
                                                                ],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [
                                                    {
                                                        "type": "dn token",
                                                        "value": 100663431
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValueEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetKeyValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RtlWriteRegistryValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetPath"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegWriteUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.RegistryKey::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663431,
                                                            75
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.Registry::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663434
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "host-interaction/process/create"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/add/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/reg(|.exe)/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hklm/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_LOCAL_MACHINE/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/hkcu/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/HKEY_CURRENT_USER/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "create or open registry key"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "or"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenCurrentUser"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegOpenUserClassesRoot"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RegCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwOpenKeyTransactedEx"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "ZwCreateKeyTransacted"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtOpenKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "NtCreateKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegOpenUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SHRegCreateUSKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "RtlCreateRegistryKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [
                                                                    {
                                                                        "type": "dn token offset",
                                                                        "value": [
                                                                            100663434,
                                                                            35
                                                                        ]
                                                                    }
                                                                ],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [
                                                    {
                                                        "type": "dn token",
                                                        "value": 100663434
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetValueEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RegSetKeyValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtSetValueKey"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "RtlWriteRegistryValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetPath"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegSetUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "SHRegWriteUSValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.RegistryKey::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663434,
                                                            86
                                                        ]
                                                    },
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663434,
                                                            130
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "Microsoft.Win32.Registry::SetValue"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "find process by name": {
            "meta": {
                "name": "find process by name",
                "namespace": "host-interaction/process/list",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "Process Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "Process Discovery",
                        "subtechnique": "",
                        "id": "T1057"
                    }
                ],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: find process by name\n    namespace: host-interaction/process/list\n    authors:\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n  features:\n    - and:\n      - api: System.Diagnostics.Process::GetProcessesByName\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::GetProcessesByName"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663319,
                                            97
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663362
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::GetProcessesByName"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663362,
                                            29
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663392
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::GetProcessesByName"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663392,
                                            29
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663392,
                                            136
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "query or enumerate registry key": {
            "meta": {
                "name": "query or enumerate registry key",
                "namespace": "host-interaction/registry",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "Query Registry"
                        ],
                        "tactic": "Discovery",
                        "technique": "Query Registry",
                        "subtechnique": "",
                        "id": "T1012"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Operating System",
                            "Registry",
                            "Query Registry Key"
                        ],
                        "objective": "Operating System",
                        "behavior": "Registry",
                        "method": "Query Registry Key",
                        "id": "C0036.005"
                    }
                ],
                "references": [],
                "examples": [
                    "493167E85E45363D09495D0841C30648:0x404930",
                    "B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402608"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: query or enumerate registry key\n    namespace: host-interaction/registry\n    authors:\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Query Registry [T1012]\n    mbc:\n      - Operating System::Registry::Query Registry Key [C0036.005]\n    examples:\n      - 493167E85E45363D09495D0841C30648:0x404930\n      - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402608\n  features:\n    - and:\n      - optional:\n        - match: create or open registry key\n      - or:\n        - api: advapi32.RegEnumKey\n        - api: advapi32.RegEnumKeyEx\n        - api: advapi32.RegQueryInfoKeyA\n        - api: ZwQueryKey\n        - api: ZwEnumerateKey\n        - api: NtQueryKey\n        - api: NtEnumerateKey\n        - api: RtlCheckRegistryKey\n        - api: SHEnumKeyEx\n        - api: SHQueryInfoKey\n        - api: SHRegEnumUSKey\n        - api: SHRegQueryInfoUSKey\n        - api: Microsoft.Win32.RegistryKey::GetSubKeyNames\n        - api: Microsoft.Win32.RegistryKey::OpenBaseKey\n        - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\n        - api: Microsoft.Win32.RegistryKey::OpenSubKey\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663319,
                                                                    315
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663319
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryInfoKeyA"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlCheckRegistryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryInfoKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryInfoUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetSubKeyNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663319,
                                                    315
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663356
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663356,
                                                                    13
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663356,
                                                                    84
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663356
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryInfoKeyA"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlCheckRegistryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryInfoKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryInfoUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetSubKeyNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663356,
                                                    13
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663357
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663357,
                                                                    20
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663357,
                                                                    61
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663357
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryInfoKeyA"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlCheckRegistryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryInfoKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryInfoUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetSubKeyNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663357,
                                                    20
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663381
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663381,
                                                                    555
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663381
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryInfoKeyA"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlCheckRegistryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryInfoKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryInfoUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetSubKeyNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663381,
                                                    555
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663431
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663431,
                                                                    56
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663431
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryInfoKeyA"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlCheckRegistryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryInfoKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryInfoUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetSubKeyNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663431,
                                                    56
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663432
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663432,
                                                                    35
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663432
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryInfoKeyA"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlCheckRegistryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryInfoKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryInfoUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetSubKeyNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663432,
                                                    35
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663434
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663434,
                                                                    35
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663434
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryInfoKeyA"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlCheckRegistryKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumKeyEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryInfoKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryInfoUSKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetSubKeyNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663434,
                                                    35
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "query or enumerate registry value": {
            "meta": {
                "name": "query or enumerate registry value",
                "namespace": "host-interaction/registry",
                "authors": [
                    "[email protected]",
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "Query Registry"
                        ],
                        "tactic": "Discovery",
                        "technique": "Query Registry",
                        "subtechnique": "",
                        "id": "T1012"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Operating System",
                            "Registry",
                            "Query Registry Value"
                        ],
                        "objective": "Operating System",
                        "behavior": "Registry",
                        "method": "Query Registry Value",
                        "id": "C0036.006"
                    }
                ],
                "references": [],
                "examples": [
                    "BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A",
                    "Practical Malware Analysis Lab 03-02.dll_:0x100047AD"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: query or enumerate registry value\n    namespace: host-interaction/registry\n    authors:\n      - [email protected]\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Query Registry [T1012]\n    mbc:\n      - Operating System::Registry::Query Registry Value [C0036.006]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\n      - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\n  features:\n    - and:\n      - optional:\n        - match: create or open registry key\n      - or:\n        - api: advapi32.RegGetValue\n        - api: advapi32.RegEnumValue\n        - api: advapi32.RegQueryValue\n        - api: advapi32.RegQueryValueEx\n        - api: advapi32.RegQueryMultipleValues\n        - api: ZwQueryValueKey\n        - api: ZwEnumerateValueKey\n        - api: NtQueryValueKey\n        - api: NtEnumerateValueKey\n        - api: RtlQueryRegistryValues\n        - api: SHGetValue\n        - api: SHEnumValue\n        - api: SHRegGetInt\n        - api: SHRegGetPath\n        - api: SHRegGetValue\n        - api: SHQueryValueEx\n        - api: SHRegGetUSValue\n        - api: SHOpenRegStream\n        - api: SHRegEnumUSValue\n        - api: SHOpenRegStream2\n        - api: SHRegQueryUSValue\n        - api: SHRegGetBoolUSValue\n        - api: SHRegGetValueFromHKCUHKLM\n        - api: SHRegGetBoolValueFromHKCUHKLM\n        - api: Microsoft.Win32.RegistryKey::GetValue\n        - api: Microsoft.Win32.RegistryKey::GetValueKind\n        - api: Microsoft.Win32.RegistryKey::GetValueNames\n        - api: Microsoft.Win32.Registry::GetValue\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663319,
                                                                    315
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663319
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryMultipleValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlQueryRegistryValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetInt"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetPath"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream2"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663319,
                                                    330
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueKind"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.Registry::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663356
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663356,
                                                                    13
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663356,
                                                                    84
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663356
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryMultipleValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlQueryRegistryValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetInt"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetPath"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream2"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663356,
                                                    118
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663356,
                                                    97
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663356,
                                                    47
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663356,
                                                    26
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueKind"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.Registry::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663381
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663381,
                                                                    555
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663381
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryMultipleValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlQueryRegistryValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetInt"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetPath"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream2"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663381,
                                                    568
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueKind"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.Registry::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663432
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663432,
                                                                    35
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663432
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryMultipleValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlQueryRegistryValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetInt"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetPath"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream2"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663432,
                                                    80
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663432,
                                                    53
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueKind"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.Registry::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663434
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "create or open registry key"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenCurrentUser"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegOpenUserClassesRoot"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RegCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwOpenKeyTransactedEx"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "ZwCreateKeyTransacted"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtOpenKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "NtCreateKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegOpenUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SHRegCreateUSKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "RtlCreateRegistryKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663434,
                                                                    35
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663434
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RegQueryMultipleValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ZwEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtQueryValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "NtEnumerateValueKey"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "RtlQueryRegistryValues"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHEnumValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetInt"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetPath"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHQueryValueEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegEnumUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHOpenRegStream2"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegQueryUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolUSValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "SHRegGetBoolValueFromHKCUHKLM"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663434,
                                                    53
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueKind"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.RegistryKey::GetValueNames"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "Microsoft.Win32.Registry::GetValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "terminate process": {
            "meta": {
                "name": "terminate process",
                "namespace": "host-interaction/process/terminate",
                "authors": [
                    "[email protected]",
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "Process",
                            "Terminate Process"
                        ],
                        "objective": "Process",
                        "behavior": "Terminate Process",
                        "method": "",
                        "id": "C0018"
                    }
                ],
                "references": [],
                "examples": [
                    "C91887D861D9BD4A5872249B641BC9F9:0x401A77",
                    "9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: terminate process\n    namespace: host-interaction/process/terminate\n    authors:\n      - [email protected]\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Process::Terminate Process [C0018]\n    examples:\n      - C91887D861D9BD4A5872249B641BC9F9:0x401A77\n      - 9B7CCAA2AE6A5B96E3110EBCBC4311F6:0x10010307\n  features:\n    - or:\n      - api: System.Diagnostics.Process::Kill\n      - api: System.Diagnostics.Process::WaitForExit\n      - api: System.Diagnostics.Process::WaitForExitAsync\n      - api: System.Environment::Exit\n      - api: System.Windows.Forms.Application::Exit\n      - api: exit\n      - api: Exit\n      - and:\n        - optional:\n          - match: open process\n        - or:\n          - api: kernel32.TerminateProcess\n          - api: ntdll.NtTerminateProcess\n          - api: kernel32.ExitProcess\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::Kill"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663319,
                                            139
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::WaitForExit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::WaitForExitAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Environment::Exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Windows.Forms.Application::Exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "open process"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "TerminateProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtTerminateProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ExitProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663383
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::Kill"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::WaitForExit"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663383,
                                            93
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::WaitForExitAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Environment::Exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Windows.Forms.Application::Exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "open process"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "TerminateProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtTerminateProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ExitProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663400
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::Kill"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663400,
                                            9
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::WaitForExit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::WaitForExitAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Environment::Exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Windows.Forms.Application::Exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "Exit"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "open process"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "TerminateProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtTerminateProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ExitProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "copy file": {
            "meta": {
                "name": "copy file",
                "namespace": "host-interaction/file-system/copy",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "File System",
                            "Copy File"
                        ],
                        "objective": "File System",
                        "behavior": "Copy File",
                        "method": "",
                        "id": "C0045"
                    }
                ],
                "references": [],
                "examples": [
                    "Practical Malware Analysis Lab 01-01.exe_:0x401440"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: copy file\n    namespace: host-interaction/file-system/copy\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Copy File [C0045]\n    examples:\n      - Practical Malware Analysis Lab 01-01.exe_:0x401440\n  features:\n    - or:\n      - api: kernel32.CopyFile\n      - api: kernel32.CopyFileEx\n      - api: CopyFile2\n      - api: CopyFileTransacted\n      - api: LZCopy\n      - api: System.IO.FileInfo::CopyTo\n      - api: System.IO.File::Copy\n      - basic block:\n        - and:\n          - number: 2 = FO_COPY\n          - or:\n            - api: kernel32.SHFileOperation\n      - call:\n        - and:\n          - number: 2 = FO_COPY\n          - or:\n            - api: kernel32.SHFileOperation\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CopyFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CopyFileEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CopyFile2"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CopyFileTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "LZCopy"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileInfo::CopyTo"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Copy"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663319,
                                            473
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "copy file/41f680d230544050b023ee48843fa9ed"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "copy file/132809d5728a483185cb467f6abba34f"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663393
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CopyFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CopyFileEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CopyFile2"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CopyFileTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "LZCopy"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileInfo::CopyTo"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Copy"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663393,
                                            227
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663393,
                                            343
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "copy file/41f680d230544050b023ee48843fa9ed"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "copy file/132809d5728a483185cb467f6abba34f"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "persist via Run registry key": {
            "meta": {
                "name": "persist via Run registry key",
                "namespace": "persistence/registry/run",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Persistence",
                            "Boot or Logon Autostart Execution",
                            "Registry Run Keys / Startup Folder"
                        ],
                        "tactic": "Persistence",
                        "technique": "Boot or Logon Autostart Execution",
                        "subtechnique": "Registry Run Keys / Startup Folder",
                        "id": "T1547.001"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Persistence",
                            "Registry Run Keys / Startup Folder"
                        ],
                        "objective": "Persistence",
                        "behavior": "Registry Run Keys / Startup Folder",
                        "method": "",
                        "id": "F0012"
                    }
                ],
                "references": [],
                "examples": [
                    "Practical Malware Analysis Lab 06-03.exe_:0x401130",
                    "b87e9dd18a5533a09d3e48a7a1efbcf6:0x1400070E0",
                    "9ff8e68343cc29c1036650fc153e69f7:0x470624"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: persist via Run registry key\n    namespace: persistence/registry/run\n    authors:\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001]\n    mbc:\n      - Persistence::Registry Run Keys / Startup Folder [F0012]\n    examples:\n      - Practical Malware Analysis Lab 06-03.exe_:0x401130\n      - b87e9dd18a5533a09d3e48a7a1efbcf6:0x1400070E0\n      - 9ff8e68343cc29c1036650fc153e69f7:0x470624\n  features:\n    - and:\n      - or:\n        - match: set registry value\n        - number: 0x80000001 = HKEY_CURRENT_USER\n        - number: 0x80000002 = HKEY_LOCAL_MACHINE\n      - or:\n        - and:\n          - string: /Software\\\\Microsoft\\\\Windows\\\\CurrentVersion/i\n          - or:\n            - string: /Run/i\n            - string: /Explorer\\\\Shell Folders/i\n            - string: /User Shell Folders/i\n            - string: /RunServices/i\n            - string: /Policies\\\\Explorer\\\\Run/i\n        - string: /Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\load/i\n        - string: /System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\BootExecute/i\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "set registry value"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "and"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "match",
                                                                        "match": "host-interaction/process/create"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "regex",
                                                                        "regex": "/add/i"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "statement",
                                                                    "statement": {
                                                                        "type": "or"
                                                                    }
                                                                },
                                                                "children": [
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/reg(|.exe)/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/hklm/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/HKEY_LOCAL_MACHINE/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/hkcu/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/HKEY_CURRENT_USER/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    }
                                                                ],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "and"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "statement",
                                                                    "statement": {
                                                                        "type": "optional"
                                                                    }
                                                                },
                                                                "children": [
                                                                    {
                                                                        "success": true,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "match",
                                                                                "match": "create or open registry key"
                                                                            }
                                                                        },
                                                                        "children": [
                                                                            {
                                                                                "success": true,
                                                                                "node": {
                                                                                    "type": "statement",
                                                                                    "statement": {
                                                                                        "type": "or"
                                                                                    }
                                                                                },
                                                                                "children": [
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenKeyEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegCreateKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegCreateKeyEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenCurrentUser"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenUserClassesRoot"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegCreateKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKeyEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwCreateKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKeyTransactedEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwCreateKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "NtOpenKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "NtCreateKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "SHRegOpenUSKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "SHRegCreateUSKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RtlCreateRegistryKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": true,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [
                                                                                            {
                                                                                                "type": "dn token offset",
                                                                                                "value": [
                                                                                                    100663319,
                                                                                                    315
                                                                                                ]
                                                                                            }
                                                                                        ],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    }
                                                                                ],
                                                                                "locations": [],
                                                                                "captures": {}
                                                                            }
                                                                        ],
                                                                        "locations": [
                                                                            {
                                                                                "type": "dn token",
                                                                                "value": 100663319
                                                                            }
                                                                        ],
                                                                        "captures": {}
                                                                    }
                                                                ],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "statement",
                                                                    "statement": {
                                                                        "type": "or"
                                                                    }
                                                                },
                                                                "children": [
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RegSetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RegSetValueEx"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RegSetKeyValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "ZwSetValueKey"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "NtSetValueKey"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RtlWriteRegistryValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHSetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegSetPath"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegSetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegSetUSValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegWriteUSValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": true,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "Microsoft.Win32.RegistryKey::SetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [
                                                                            {
                                                                                "type": "dn token offset",
                                                                                "value": [
                                                                                    100663319,
                                                                                    358
                                                                                ]
                                                                            }
                                                                        ],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "Microsoft.Win32.Registry::SetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    }
                                                                ],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663319
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "number",
                                                "number": 2147483649,
                                                "description": "HKEY_CURRENT_USER"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "number",
                                                "number": 2147483650,
                                                "description": "HKEY_LOCAL_MACHINE"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "and"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/Software\\\\Microsoft\\\\Windows\\\\CurrentVersion/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663319,
                                                            309
                                                        ]
                                                    }
                                                ],
                                                "captures": {
                                                    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run": [
                                                        {
                                                            "type": "dn token offset",
                                                            "value": [
                                                                100663319,
                                                                309
                                                            ]
                                                        }
                                                    ]
                                                }
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/Run/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663319,
                                                                    309
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {
                                                            "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run": [
                                                                {
                                                                    "type": "dn token offset",
                                                                    "value": [
                                                                        100663319,
                                                                        309
                                                                    ]
                                                                }
                                                            ]
                                                        }
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/Explorer\\\\Shell Folders/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/User Shell Folders/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/RunServices/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/Policies\\\\Explorer\\\\Run/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\load/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\BootExecute/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663381
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "set registry value"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "and"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "match",
                                                                        "match": "host-interaction/process/create"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "regex",
                                                                        "regex": "/add/i"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "statement",
                                                                    "statement": {
                                                                        "type": "or"
                                                                    }
                                                                },
                                                                "children": [
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/reg(|.exe)/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/hklm/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/HKEY_LOCAL_MACHINE/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/hkcu/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/HKEY_CURRENT_USER/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    }
                                                                ],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "and"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "statement",
                                                                    "statement": {
                                                                        "type": "optional"
                                                                    }
                                                                },
                                                                "children": [
                                                                    {
                                                                        "success": true,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "match",
                                                                                "match": "create or open registry key"
                                                                            }
                                                                        },
                                                                        "children": [
                                                                            {
                                                                                "success": true,
                                                                                "node": {
                                                                                    "type": "statement",
                                                                                    "statement": {
                                                                                        "type": "or"
                                                                                    }
                                                                                },
                                                                                "children": [
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenKeyEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegCreateKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegCreateKeyEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenCurrentUser"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenUserClassesRoot"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegCreateKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKeyEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwCreateKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKeyTransactedEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwCreateKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "NtOpenKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "NtCreateKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "SHRegOpenUSKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "SHRegCreateUSKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RtlCreateRegistryKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": true,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [
                                                                                            {
                                                                                                "type": "dn token offset",
                                                                                                "value": [
                                                                                                    100663381,
                                                                                                    555
                                                                                                ]
                                                                                            }
                                                                                        ],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    }
                                                                                ],
                                                                                "locations": [],
                                                                                "captures": {}
                                                                            }
                                                                        ],
                                                                        "locations": [
                                                                            {
                                                                                "type": "dn token",
                                                                                "value": 100663381
                                                                            }
                                                                        ],
                                                                        "captures": {}
                                                                    }
                                                                ],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "statement",
                                                                    "statement": {
                                                                        "type": "or"
                                                                    }
                                                                },
                                                                "children": [
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RegSetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RegSetValueEx"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RegSetKeyValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "ZwSetValueKey"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "NtSetValueKey"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RtlWriteRegistryValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHSetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegSetPath"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegSetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegSetUSValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegWriteUSValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": true,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "Microsoft.Win32.RegistryKey::SetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [
                                                                            {
                                                                                "type": "dn token offset",
                                                                                "value": [
                                                                                    100663381,
                                                                                    594
                                                                                ]
                                                                            }
                                                                        ],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "Microsoft.Win32.Registry::SetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    }
                                                                ],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663381
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "number",
                                                "number": 2147483649,
                                                "description": "HKEY_CURRENT_USER"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "number",
                                                "number": 2147483650,
                                                "description": "HKEY_LOCAL_MACHINE"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "and"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/Software\\\\Microsoft\\\\Windows\\\\CurrentVersion/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663381,
                                                            549
                                                        ]
                                                    }
                                                ],
                                                "captures": {
                                                    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run": [
                                                        {
                                                            "type": "dn token offset",
                                                            "value": [
                                                                100663381,
                                                                549
                                                            ]
                                                        }
                                                    ]
                                                }
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/Run/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663381,
                                                                    549
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {
                                                            "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run": [
                                                                {
                                                                    "type": "dn token offset",
                                                                    "value": [
                                                                        100663381,
                                                                        549
                                                                    ]
                                                                }
                                                            ]
                                                        }
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/Explorer\\\\Shell Folders/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/User Shell Folders/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/RunServices/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/Policies\\\\Explorer\\\\Run/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\load/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\BootExecute/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663434
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "set registry value"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "and"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "match",
                                                                        "match": "host-interaction/process/create"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "regex",
                                                                        "regex": "/add/i"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": false,
                                                                "node": {
                                                                    "type": "statement",
                                                                    "statement": {
                                                                        "type": "or"
                                                                    }
                                                                },
                                                                "children": [
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/reg(|.exe)/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/hklm/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/HKEY_LOCAL_MACHINE/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/hkcu/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "regex",
                                                                                "regex": "/HKEY_CURRENT_USER/i"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    }
                                                                ],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "and"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "statement",
                                                                    "statement": {
                                                                        "type": "optional"
                                                                    }
                                                                },
                                                                "children": [
                                                                    {
                                                                        "success": true,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "match",
                                                                                "match": "create or open registry key"
                                                                            }
                                                                        },
                                                                        "children": [
                                                                            {
                                                                                "success": true,
                                                                                "node": {
                                                                                    "type": "statement",
                                                                                    "statement": {
                                                                                        "type": "or"
                                                                                    }
                                                                                },
                                                                                "children": [
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenKeyEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegCreateKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegCreateKeyEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenCurrentUser"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegOpenUserClassesRoot"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RegCreateKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKeyEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwCreateKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwOpenKeyTransactedEx"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "ZwCreateKeyTransacted"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "NtOpenKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "NtCreateKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "SHRegOpenUSKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "SHRegCreateUSKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "RtlCreateRegistryKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": true,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::OpenSubKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [
                                                                                            {
                                                                                                "type": "dn token offset",
                                                                                                "value": [
                                                                                                    100663434,
                                                                                                    35
                                                                                                ]
                                                                                            }
                                                                                        ],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::OpenBaseKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    },
                                                                                    {
                                                                                        "success": false,
                                                                                        "node": {
                                                                                            "type": "feature",
                                                                                            "feature": {
                                                                                                "type": "api",
                                                                                                "api": "Microsoft.Win32.RegistryKey::CreateSubKey"
                                                                                            }
                                                                                        },
                                                                                        "children": [],
                                                                                        "locations": [],
                                                                                        "captures": {}
                                                                                    }
                                                                                ],
                                                                                "locations": [],
                                                                                "captures": {}
                                                                            }
                                                                        ],
                                                                        "locations": [
                                                                            {
                                                                                "type": "dn token",
                                                                                "value": 100663434
                                                                            }
                                                                        ],
                                                                        "captures": {}
                                                                    }
                                                                ],
                                                                "locations": [],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "statement",
                                                                    "statement": {
                                                                        "type": "or"
                                                                    }
                                                                },
                                                                "children": [
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RegSetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RegSetValueEx"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RegSetKeyValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "ZwSetValueKey"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "NtSetValueKey"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "RtlWriteRegistryValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHSetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegSetPath"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegSetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegSetUSValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "SHRegWriteUSValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": true,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "Microsoft.Win32.RegistryKey::SetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [
                                                                            {
                                                                                "type": "dn token offset",
                                                                                "value": [
                                                                                    100663434,
                                                                                    86
                                                                                ]
                                                                            },
                                                                            {
                                                                                "type": "dn token offset",
                                                                                "value": [
                                                                                    100663434,
                                                                                    130
                                                                                ]
                                                                            }
                                                                        ],
                                                                        "captures": {}
                                                                    },
                                                                    {
                                                                        "success": false,
                                                                        "node": {
                                                                            "type": "feature",
                                                                            "feature": {
                                                                                "type": "api",
                                                                                "api": "Microsoft.Win32.Registry::SetValue"
                                                                            }
                                                                        },
                                                                        "children": [],
                                                                        "locations": [],
                                                                        "captures": {}
                                                                    }
                                                                ],
                                                                "locations": [],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663434
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "number",
                                                "number": 2147483649,
                                                "description": "HKEY_CURRENT_USER"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "number",
                                                "number": 2147483650,
                                                "description": "HKEY_LOCAL_MACHINE"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "and"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "regex",
                                                        "regex": "/Software\\\\Microsoft\\\\Windows\\\\CurrentVersion/i"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663434,
                                                            2
                                                        ]
                                                    }
                                                ],
                                                "captures": {
                                                    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|arfmors": [
                                                        {
                                                            "type": "dn token offset",
                                                            "value": [
                                                                100663434,
                                                                2
                                                            ]
                                                        }
                                                    ]
                                                }
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/Run/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663434,
                                                                    2
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {
                                                            "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|arfmors": [
                                                                {
                                                                    "type": "dn token offset",
                                                                    "value": [
                                                                        100663434,
                                                                        2
                                                                    ]
                                                                }
                                                            ]
                                                        }
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/Explorer\\\\Shell Folders/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/User Shell Folders/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/RunServices/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "regex",
                                                                "regex": "/Policies\\\\Explorer\\\\Run/i"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\load/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "regex",
                                                "regex": "/System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\BootExecute/i"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "terminate process by name in .NET": {
            "meta": {
                "name": "terminate process by name in .NET",
                "namespace": "host-interaction/process/terminate",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: terminate process by name in .NET\n    namespace: host-interaction/process/terminate\n    authors:\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n  features:\n    - and:\n      - api: System.Diagnostics.Process::GetProcessesByName\n      - api: System.Diagnostics.Process::Kill\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::GetProcessesByName"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663319,
                                            97
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Diagnostics.Process::Kill"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663319,
                                            139
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "check if directory exists": {
            "meta": {
                "name": "check if directory exists",
                "namespace": "host-interaction/file-system/exists",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "File and Directory Discovery",
                        "subtechnique": "",
                        "id": "T1083"
                    }
                ],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: check if directory exists\n    namespace: host-interaction/file-system/exists\n    authors:\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n  features:\n    - or:\n      - api: System.IO.Directory::Exists\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663319,
                                            421
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663342
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663342,
                                            8
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663343
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663343,
                                            8
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663381
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            632
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            132
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            8
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            415
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            511
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            186
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            279
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663413
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663413,
                                            41
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663421
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663421,
                                            44
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663429
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663429,
                                            231
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "create directory": {
            "meta": {
                "name": "create directory",
                "namespace": "host-interaction/file-system/create",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "File System",
                            "Create Directory"
                        ],
                        "objective": "File System",
                        "behavior": "Create Directory",
                        "method": "",
                        "id": "C0046"
                    }
                ],
                "references": [],
                "examples": [
                    "Practical Malware Analysis Lab 17-02.dll_:0x10008f62",
                    "692f7fd6d198e804d6af98eb9e390d61:0x6000003"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: create directory\n    namespace: host-interaction/file-system/create\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n    mbc:\n      - File System::Create Directory [C0046]\n    examples:\n      - Practical Malware Analysis Lab 17-02.dll_:0x10008f62\n      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n  features:\n    - or:\n      - api: kernel32.CreateDirectory\n      - api: kernel32.CreateDirectoryEx\n      - api: kernel32.CreateDirectoryTransacted\n      - api: NtCreateDirectoryObject\n      - api: ZwCreateDirectoryObject\n      - api: SHCreateDirectory\n      - api: SHCreateDirectoryEx\n      - api: mkdir\n      - api: _mkdir\n      - api: _wmkdir\n      - api: System.IO.Directory::CreateDirectory\n      - api: System.IO.DirectoryInfo::Create\n      - api: System.IO.DirectoryInfo::CreateSubdirectory\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663319
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_wmkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663319,
                                            439
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::Create"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::CreateSubdirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663381
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_wmkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            292
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            428
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            645
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            150
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            529
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            199
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            26
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::Create"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::CreateSubdirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663413
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_wmkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663413,
                                            55
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::Create"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::CreateSubdirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663421
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_wmkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663421,
                                            58
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::Create"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::CreateSubdirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663429
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "CreateDirectoryTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwCreateDirectoryObject"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "SHCreateDirectoryEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_mkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_wmkdir"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::CreateDirectory"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663429,
                                            245
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::Create"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::CreateSubdirectory"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "unmanaged call": {
            "meta": {
                "name": "unmanaged call",
                "namespace": "runtime",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function"
                },
                "attack": [],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "managed code calls unmanaged (native) code, often seen in .NET",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: unmanaged call\n    namespace: runtime\n    authors:\n      - [email protected]\n    description: managed code calls unmanaged (native) code, often seen in .NET\n    scopes:\n      static: function\n      dynamic: unsupported\n  features:\n    - or:\n      - characteristic: unmanaged call\n      - match: unmanaged call via dynamic PInvoke in .NET\n      - api: System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663323
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "characteristic",
                                        "characteristic": "unmanaged call"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663323,
                                            15
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "unmanaged call via dynamic PInvoke in .NET"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663324
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "characteristic",
                                        "characteristic": "unmanaged call"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663324,
                                            24
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663324,
                                            47
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "unmanaged call via dynamic PInvoke in .NET"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663325
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "characteristic",
                                        "characteristic": "unmanaged call"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663325,
                                            14
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663325,
                                            28
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663325,
                                            52
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "unmanaged call via dynamic PInvoke in .NET"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663326
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "characteristic",
                                        "characteristic": "unmanaged call"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663326,
                                            40
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663326,
                                            21
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "unmanaged call via dynamic PInvoke in .NET"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663328
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "characteristic",
                                        "characteristic": "unmanaged call"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            109
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            25
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            65
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            76
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            127
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            8
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            152
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            1
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            87
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            135
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663328,
                                            119
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "unmanaged call via dynamic PInvoke in .NET"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Runtime.InteropServices.Marshal::GetDelegateForFunctionPointer"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "capture webcam image": {
            "meta": {
                "name": "capture webcam image",
                "namespace": "collection/webcam",
                "authors": [
                    "johnk3r"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Collection",
                            "Video Capture"
                        ],
                        "tactic": "Collection",
                        "technique": "Video Capture",
                        "subtechnique": "",
                        "id": "T1125"
                    }
                ],
                "mbc": [],
                "references": [],
                "examples": [
                    "a30101595f6f28ab2f4b0b2cd177c3c4d2ab34a355ab7761a3795d0887c24ada:0x4011C0"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: capture webcam image\n    namespace: collection/webcam\n    authors:\n      - johnk3r\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Collection::Video Capture [T1125]\n    examples:\n      - a30101595f6f28ab2f4b0b2cd177c3c4d2ab34a355ab7761a3795d0887c24ada:0x4011C0\n  features:\n    - or:\n      # static\n      - and:\n        - api: capCreateCaptureWindow\n        - basic block:\n          - and:\n            - api: SendMessage\n            - number: 0x40a = WM_CAP_DRIVER_CONNECT\n        - optional:\n          - basic block:\n            - and:\n              - api: SendMessage\n              - number: 0x40B = WM_CAP_DRIVER_DISCONNECT\n      - basic block:\n        - and:\n          - api: SendMessage\n          - number: 0x419 = WM_CAP_FILE_SAVEDIB\n      # dynamic\n      - and:\n        - api: capCreateCaptureWindow\n        - call:\n          - and:\n            - api: SendMessage\n            - number: 0x40a = WM_CAP_DRIVER_CONNECT\n        - optional:\n          - call:\n            - and:\n              - api: SendMessage\n              - number: 0x40B = WM_CAP_DRIVER_DISCONNECT\n      - call:\n        - and:\n          - api: SendMessage\n          - number: 0x419 = WM_CAP_FILE_SAVEDIB\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663324
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "capture webcam image/1fa8c49e81514c6fb8890a0310583ce5"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "capture webcam image/0b23b2ed8d5441e59ae457d025164db3"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "capCreateCaptureWindow"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663324,
                                                    24
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "subscope",
                                                "scope": "basic block"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SendMessage"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663324,
                                                                    47
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 1034,
                                                                "description": "WM_CAP_DRIVER_CONNECT"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663324,
                                                                    40
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663324
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "capture webcam image/c8baea2657db42a99f4d3975edacb33d"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "capCreateCaptureWindow"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663324,
                                                    24
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "capture webcam image/c72ec4f4128d484dab1d1f9cf414f205"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "capture webcam image/c7692f895e114e0eb290685826ee7a0a"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663325
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "capture webcam image/1fa8c49e81514c6fb8890a0310583ce5"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "capture webcam image/0b23b2ed8d5441e59ae457d025164db3"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "capCreateCaptureWindow"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663325,
                                                    14
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "subscope",
                                                "scope": "basic block"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "SendMessage"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663325,
                                                                    28
                                                                ]
                                                            },
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663325,
                                                                    52
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 1034,
                                                                "description": "WM_CAP_DRIVER_CONNECT"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663325,
                                                                    21
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [
                                            {
                                                "type": "dn token",
                                                "value": 100663325
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "subscope",
                                                        "scope": "basic block"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "statement",
                                                            "statement": {
                                                                "type": "and"
                                                            }
                                                        },
                                                        "children": [
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "api",
                                                                        "api": "SendMessage"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [
                                                                    {
                                                                        "type": "dn token offset",
                                                                        "value": [
                                                                            100663325,
                                                                            28
                                                                        ]
                                                                    },
                                                                    {
                                                                        "type": "dn token offset",
                                                                        "value": [
                                                                            100663325,
                                                                            52
                                                                        ]
                                                                    }
                                                                ],
                                                                "captures": {}
                                                            },
                                                            {
                                                                "success": true,
                                                                "node": {
                                                                    "type": "feature",
                                                                    "feature": {
                                                                        "type": "number",
                                                                        "number": 1035,
                                                                        "description": "WM_CAP_DRIVER_DISCONNECT"
                                                                    }
                                                                },
                                                                "children": [],
                                                                "locations": [
                                                                    {
                                                                        "type": "dn token offset",
                                                                        "value": [
                                                                            100663325,
                                                                            45
                                                                        ]
                                                                    }
                                                                ],
                                                                "captures": {}
                                                            }
                                                        ],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [
                                                    {
                                                        "type": "dn token",
                                                        "value": 100663325
                                                    }
                                                ],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "capCreateCaptureWindow"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663325,
                                                    14
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "capture webcam image/c72ec4f4128d484dab1d1f9cf414f205"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "capture webcam image/c7692f895e114e0eb290685826ee7a0a"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "save image in .NET": {
            "meta": {
                "name": "save image in .NET",
                "namespace": "collection",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function"
                },
                "attack": [],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: save image in .NET\n    namespace: collection\n    authors:\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: unsupported  # requires class features\n  features:\n    - and:\n      - api: System.Drawing.Image::Save\n      - optional:\n        - class: System.Drawing.Imaging.ImageFormat\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663326
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Drawing.Image::Save"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663326,
                                            129
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "class",
                                                "class_": "System.Drawing.Imaging.ImageFormat"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663326,
                                                    124
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663377
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Drawing.Image::Save"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663377,
                                            43
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "class",
                                                "class_": "System.Drawing.Imaging.ImageFormat"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663377,
                                                    38
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663384
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Drawing.Image::Save"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663384,
                                            56
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "class",
                                                "class_": "System.Drawing.Imaging.ImageFormat"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663384,
                                                    51
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663386
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Drawing.Image::Save"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663386,
                                            90
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "class",
                                                "class_": "System.Drawing.Imaging.ImageFormat"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663386,
                                                    85
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663391
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Drawing.Image::Save"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663391,
                                            61
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "class",
                                                "class_": "System.Drawing.Imaging.ImageFormat"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663391,
                                                    56
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "read clipboard data": {
            "meta": {
                "name": "read clipboard data",
                "namespace": "host-interaction/clipboard",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Collection",
                            "Clipboard Data"
                        ],
                        "tactic": "Collection",
                        "technique": "Clipboard Data",
                        "subtechnique": "",
                        "id": "T1115"
                    }
                ],
                "mbc": [],
                "references": [
                    "https://learn.microsoft.com/en-us/windows/win32/dataxchg/using-the-clipboard"
                ],
                "examples": [
                    "C91887D861D9BD4A5872249B641BC9F9:0x40156F",
                    "93dfc146f60bd796eb28d4e4f348f2e4:0x401050"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: read clipboard data\n    namespace: host-interaction/clipboard\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Collection::Clipboard Data [T1115]\n    references:\n      - https://learn.microsoft.com/en-us/windows/win32/dataxchg/using-the-clipboard\n    examples:\n      - C91887D861D9BD4A5872249B641BC9F9:0x40156F\n      - 93dfc146f60bd796eb28d4e4f348f2e4:0x401050\n  features:\n    - and:\n      - optional:\n        - match: open clipboard\n        - match: contain loop\n        - api: kernel32.GlobalAlloc\n        - api: kernel32.GlobalLock\n        - api: kernel32.GlobalUnlock\n      - or:\n        - basic block:\n          - and:\n            - api: user32.GetClipboardData\n            - optional:\n              - number: 0x1 = CF_TEXT\n              - number: 0x7 = CF_OEMTEXT\n              - number: 0xD = CF_UNICODETEXT\n        - call:\n          - and:\n            - api: user32.GetClipboardData\n            - optional:\n              - number: 0x1 = CF_TEXT\n              - number: 0x7 = CF_OEMTEXT\n              - number: 0xD = CF_UNICODETEXT\n        - api: System.Windows.Forms.Clipboard::GetAudioStream\n        - api: System.Windows.Forms.Clipboard::GetData\n        - api: System.Windows.Forms.Clipboard::GetDataObject\n        - api: System.Windows.Forms.Clipboard::GetFileDropList\n        - api: System.Windows.Forms.Clipboard::GetImage\n        - api: System.Windows.Forms.Clipboard::GetText\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663326
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "open clipboard"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "contain loop"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "GlobalAlloc"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "GlobalLock"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "GlobalUnlock"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "read clipboard data/3230f2574b5642e687d88e9540473a29"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "match",
                                                "match": "read clipboard data/0b1a8c2cf76d4aaaa1e06ada9a872ab5"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Windows.Forms.Clipboard::GetAudioStream"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Windows.Forms.Clipboard::GetData"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Windows.Forms.Clipboard::GetDataObject"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663326,
                                                    46
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Windows.Forms.Clipboard::GetFileDropList"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Windows.Forms.Clipboard::GetImage"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Windows.Forms.Clipboard::GetText"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "clear clipboard data": {
            "meta": {
                "name": "clear clipboard data",
                "namespace": "host-interaction/clipboard",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [
                    {
                        "parts": [
                            "Collection",
                            "Clipboard Data"
                        ],
                        "tactic": "Collection",
                        "technique": "Clipboard Data",
                        "subtechnique": "",
                        "id": "T1115"
                    }
                ],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: clear clipboard data\n    namespace: host-interaction/clipboard\n    authors:\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Collection::Clipboard Data [T1115]\n  features:\n    - and:\n      - api: System.Windows.Forms.Clipboard::Clear\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663326
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Windows.Forms.Clipboard::Clear"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663326,
                                            135
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663326,
                                            176
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663326,
                                            2
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663326,
                                            67
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "capture screenshot": {
            "meta": {
                "name": "capture screenshot",
                "namespace": "collection/screenshot",
                "authors": [
                    "[email protected]",
                    "@_re_fox",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Collection",
                            "Screen Capture"
                        ],
                        "tactic": "Collection",
                        "technique": "Screen Capture",
                        "subtechnique": "",
                        "id": "T1113"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Collection",
                            "Screen Capture",
                            "WinAPI"
                        ],
                        "objective": "Collection",
                        "behavior": "Screen Capture",
                        "method": "WinAPI",
                        "id": "E1113.m01"
                    }
                ],
                "references": [],
                "examples": [
                    "BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A",
                    "7204e3efc2434012e13ca939db0d0b02:0x414070",
                    "50D5EE1CE2CA5E30C6B1019EE64EEEC2:0x406E07"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: capture screenshot\n    namespace: collection/screenshot\n    authors:\n      - [email protected]\n      - \"@_re_fox\"\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Collection::Screen Capture [T1113]\n    mbc:\n      - Collection::Screen Capture::WinAPI [E1113.m01]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A\n      - 7204e3efc2434012e13ca939db0d0b02:0x414070\n      - 50D5EE1CE2CA5E30C6B1019EE64EEEC2:0x406E07\n  features:\n    - or:\n      - and:\n        - or:\n          - api: user32.GetWindowDC\n          - api: user32.GetDC\n          - and:\n            - api: gdi32.CreateDC\n            - string: \"DISPLAY\"\n        - or:\n          - api: gdi32.BitBlt\n          - api: gdi32.GetDIBits\n        - api: gdi32.CreateCompatibleDC\n        - api: gdi32.CreateCompatibleBitmap\n        - optional:\n          - or:\n            - api: user32.GetSystemMetrics = fetch screen dimensions\n            - api: user32.GetDesktopWindow = get entire desktop\n      - basic block:\n        - and:\n          - api: BitBlt\n          - characteristic: tight loop\n      - call:\n        - and:\n          - api: BitBlt\n      - api: System.Drawing.Graphics::CopyFromScreen\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663328
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "capture screenshot/93f19a2cb52b4817aca75ff85984593c"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "capture screenshot/ebaf22583956404b9fd7bc2171c9a02a"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Drawing.Graphics::CopyFromScreen"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetWindowDC"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663328,
                                                            8
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetDC"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "CreateDC"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "string",
                                                                "string": "DISPLAY"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "BitBlt"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663328,
                                                            109
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetDIBits"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "CreateCompatibleDC"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663328,
                                                    65
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "CreateCompatibleBitmap"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663328,
                                                    76
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "or"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "GetSystemMetrics",
                                                                "description": "fetch screen dimensions"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "api",
                                                                "api": "GetDesktopWindow",
                                                                "description": "get entire desktop"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "dn token offset",
                                                                "value": [
                                                                    100663328,
                                                                    1
                                                                ]
                                                            }
                                                        ],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "enumerate drives": {
            "meta": {
                "name": "enumerate drives",
                "namespace": "host-interaction/file-system",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: enumerate drives\n    namespace: host-interaction/file-system\n    authors:\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n  features:\n    - or:\n      - api: System.IO.DriveInfo::GetDrives\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663341
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DriveInfo::GetDrives"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663341,
                                            7
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663348
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DriveInfo::GetDrives"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663348,
                                            144
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "get disk information": {
            "meta": {
                "name": "get disk information",
                "namespace": "host-interaction/hardware/storage",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "System Information Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "System Information Discovery",
                        "subtechnique": "",
                        "id": "T1082"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Discovery",
                            "System Information Discovery"
                        ],
                        "objective": "Discovery",
                        "behavior": "System Information Discovery",
                        "method": "",
                        "id": "E1082"
                    }
                ],
                "references": [],
                "examples": [
                    "9324D1A8AE37A36AE560C37448C9705A:0x4052A0",
                    "972B219F18379907A045431303F4DA7D:0x41064E"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: get disk information\n    namespace: host-interaction/hardware/storage\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\n      - 972B219F18379907A045431303F4DA7D:0x41064E\n  features:\n    - or:\n      - api: kernel32.GetDriveType\n      - api: kernel32.GetLogicalDrives\n      - api: kernel32.GetVolumeInformation\n      - api: kernel32.GetVolumeNameForVolumeMountPoint\n      - api: kernel32.GetVolumePathNamesForVolumeName\n      - api: kernel32.GetLogicalDriveStrings\n      - api: kernel32.QueryDosDevice\n      - property/read: System.IO.DriveInfo::VolumeLabel\n      - property/read: System.IO.DriveInfo::DriveType\n      - property/read: System.IO.DriveInfo::DriveFormat\n      - property/read: System.IO.DriveInfo::Name\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663341
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetDriveType"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetLogicalDrives"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetVolumeInformation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetVolumeNameForVolumeMountPoint"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetVolumePathNamesForVolumeName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetLogicalDriveStrings"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "QueryDosDevice"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.DriveInfo::VolumeLabel"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.DriveInfo::DriveType"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.DriveInfo::DriveFormat"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.DriveInfo::Name"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663341,
                                            45
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663348
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetDriveType"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetLogicalDrives"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetVolumeInformation"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetVolumeNameForVolumeMountPoint"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetVolumePathNamesForVolumeName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetLogicalDriveStrings"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "QueryDosDevice"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.DriveInfo::VolumeLabel"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.DriveInfo::DriveType"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.DriveInfo::DriveFormat"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.DriveInfo::Name"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663348,
                                            200
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "enumerate files in .NET": {
            "meta": {
                "name": "enumerate files in .NET",
                "namespace": "host-interaction/file-system/files/list",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "File and Directory Discovery",
                        "subtechnique": "",
                        "id": "T1083"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "objective": "Discovery",
                        "behavior": "File and Directory Discovery",
                        "method": "",
                        "id": "E1083"
                    }
                ],
                "references": [
                    "https://github.com/hfiref0x/TDL/blob/cc4b46ae1c939b14a22a734a727b163f873a41b"
                ],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: enumerate files in .NET\n    namespace: host-interaction/file-system/files/list\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    references:\n      - https://github.com/hfiref0x/TDL/blob/cc4b46ae1c939b14a22a734a727b163f873a41b\n  features:\n    - or:\n      - api: System.IO.DirectoryInfo::GetFiles\n      - api: System.IO.DirectoryInfo::EnumerateFiles\n      - api: System.IO.Directory::GetFiles\n      - api: System.IO.Directory::EnumerateFiles\n      - api: System.IO.Directory::EnumerateFileSystemEntries\n      - api: System.IO.DirectoryInfo::GetDirectories\n      - api: System.IO.DirectoryInfo::EnumerateDirectories\n      - api: System.IO.Directory::GetDirectories\n      - api: System.IO.Directory::EnumerateDirectories\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663342
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::GetFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::EnumerateFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateFileSystemEntries"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::GetDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::EnumerateDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663342,
                                            24
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663343
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::GetFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::EnumerateFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetFiles"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663343,
                                            24
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateFileSystemEntries"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::GetDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::EnumerateDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663344
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::GetFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::EnumerateFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateFileSystemEntries"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::GetDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663344,
                                            10
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::EnumerateDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663447
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::GetFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::EnumerateFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetFiles"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663447,
                                            220
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateFiles"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateFileSystemEntries"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::GetDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.DirectoryInfo::EnumerateDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::GetDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663447,
                                            99
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.Directory::EnumerateDirectories"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "read file on Windows": {
            "meta": {
                "name": "read file on Windows",
                "namespace": "host-interaction/file-system/read",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "File System",
                            "Read File"
                        ],
                        "objective": "File System",
                        "behavior": "Read File",
                        "method": "",
                        "id": "C0051"
                    }
                ],
                "references": [],
                "examples": [
                    "BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: read file on Windows\n    namespace: host-interaction/file-system/read\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Read File [C0051]\n    examples:\n      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B\n  features:\n    - or:\n      - and:\n        - os: windows\n        - optional:\n          - and:\n            - number: 0x80000000 = GENERIC_READ\n            - match: create or open file\n        - or:\n          - api: kernel32.ReadFile\n          - api: ReadFileEx\n          - api: NtReadFile\n          - api: ZwReadFile\n          - api: LZRead\n          - api: _read\n          - api: fread\n      - api: System.IO.File::ReadAllBytes\n      - api: System.IO.File::ReadAllBytesAsync\n      - api: System.IO.File::ReadAllLines\n      - api: System.IO.File::ReadAllLinesAsync\n      - api: System.IO.File::ReadAllText\n      - api: System.IO.File::ReadAllTextAsync\n      - api: System.IO.File::ReadLines\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663353
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663353,
                                            54
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 2147483648,
                                                                "description": "GENERIC_READ"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "match",
                                                                "match": "create or open file"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "LZRead"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_read"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663366
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663366,
                                            124
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 2147483648,
                                                                "description": "GENERIC_READ"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "match",
                                                                "match": "create or open file"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "LZRead"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_read"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663382
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663382,
                                            26
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 2147483648,
                                                                "description": "GENERIC_READ"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "match",
                                                                "match": "create or open file"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "LZRead"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_read"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663393
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663393,
                                            255
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663393,
                                            371
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 2147483648,
                                                                "description": "GENERIC_READ"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "match",
                                                                "match": "create or open file"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "LZRead"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_read"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663429
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663429,
                                            326
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::ReadLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 2147483648,
                                                                "description": "GENERIC_READ"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "match",
                                                                "match": "create or open file"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ReadFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwReadFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "LZRead"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_read"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fread"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "check if file exists": {
            "meta": {
                "name": "check if file exists",
                "namespace": "host-interaction/file-system/exists",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "File and Directory Discovery",
                        "subtechnique": "",
                        "id": "T1083"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "objective": "Discovery",
                        "behavior": "File and Directory Discovery",
                        "method": "",
                        "id": "E1083"
                    }
                ],
                "references": [],
                "examples": [
                    "31600AD0D1A7EA615690DF111AE36C73:0x401284"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: check if file exists\n    namespace: host-interaction/file-system/exists\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401284\n  features:\n    - or:\n      - basic block:\n        - and:\n          - api: kernel32.GetFileAttributes\n          - instruction:\n            - mnemonic: cmp\n            - number: 0xFFFFFFFF = INVALID_FILE_ATTRIBUTES\n      - basic block:\n        - and:\n          - api: kernel32.GetLastError\n          - instruction:\n            - mnemonic: cmp\n            - number: 2 = ERROR_FILE_NOT_FOUND\n      - api: shlwapi.PathFileExists\n      - api: System.IO.File::Exists\n      - property/read: System.IO.FileSystemInfo::Exists\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663353
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663353,
                                            19
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663362
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663362,
                                            90
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663364
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663364,
                                            152
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663364,
                                            68
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663364,
                                            110
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663364,
                                            235
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663364,
                                            25
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663364,
                                            194
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663366
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663366,
                                            19
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663366,
                                            94
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663370
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663370,
                                            276
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663382
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663382,
                                            3
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663392
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663392,
                                            66
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663392,
                                            173
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663393
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663393,
                                            19
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663393,
                                            54
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663397
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663397,
                                            337
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663399
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663399,
                                            34
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663415
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663415,
                                            40
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663422
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663422,
                                            3
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663423
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663423,
                                            125
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663423,
                                            78
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663429
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/139deda230594a78a26f1c05d5228890"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "check if file exists/6f8ecef7991a4743b088045b6040fefd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "PathFileExists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663429,
                                            181
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663429,
                                            288
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileSystemInfo::Exists"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "get session user name": {
            "meta": {
                "name": "get session user name",
                "namespace": "host-interaction/session",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "System Owner/User Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "System Owner/User Discovery",
                        "subtechnique": "",
                        "id": "T1033"
                    },
                    {
                        "parts": [
                            "Discovery",
                            "Account Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "Account Discovery",
                        "subtechnique": "",
                        "id": "T1087"
                    }
                ],
                "mbc": [],
                "references": [],
                "examples": [
                    "Practical Malware Analysis Lab 14-01.exe_:0x401285"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: get session user name\n    namespace: host-interaction/session\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Owner/User Discovery [T1033]\n      - Discovery::Account Discovery [T1087]\n    examples:\n      - Practical Malware Analysis Lab 14-01.exe_:0x401285\n  features:\n    - or:\n      - api: advapi32.GetUserName\n      - api: secur32.GetUserNameEx\n      - basic block:\n        - and:\n          # - match: get session information (see #463)\n          - api: wtsapi32.WTSQuerySessionInformation\n          - number: 5 = WTSUserName\n      - call:\n        - and:\n          - api: wtsapi32.WTSQuerySessionInformation\n          - number: 5 = WTSUserName\n      - api: System.Security.Principal.WindowsIdentity::GetCurrent\n      - property/read: System.Environment::UserName\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663361
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetUserName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetUserNameEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "get session user name/bb5198d8afdd4ad4993bd55904d964c0"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "get session user name/e85e91f003d9402aae7ed3cef9718d42"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Security.Principal.WindowsIdentity::GetCurrent"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::UserName"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663361,
                                            66
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663411
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetUserName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetUserNameEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "get session user name/bb5198d8afdd4ad4993bd55904d964c0"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "get session user name/e85e91f003d9402aae7ed3cef9718d42"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Security.Principal.WindowsIdentity::GetCurrent"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::UserName"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663411,
                                            7
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "get hostname": {
            "meta": {
                "name": "get hostname",
                "namespace": "host-interaction/os/hostname",
                "authors": [
                    "[email protected]",
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "System Information Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "System Information Discovery",
                        "subtechnique": "",
                        "id": "T1082"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Discovery",
                            "System Information Discovery"
                        ],
                        "objective": "Discovery",
                        "behavior": "System Information Discovery",
                        "method": "",
                        "id": "E1082"
                    }
                ],
                "references": [],
                "examples": [
                    "9324D1A8AE37A36AE560C37448C9705A:0x4052A0",
                    "7351f8a40c5450557b24622417fc478d:0x405438"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: get hostname\n    namespace: host-interaction/os/hostname\n    authors:\n      - [email protected]\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n    mbc:\n      - Discovery::System Information Discovery [E1082]\n    examples:\n      - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\n      - 7351f8a40c5450557b24622417fc478d:0x405438\n  features:\n    - or:\n      - api: kernel32.GetComputerName\n      - api: kernel32.GetComputerNameEx\n      - api: GetComputerObjectName\n      - api: ws2_32.gethostname\n      - api: gethostname\n      - property/read: System.Environment::MachineName\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663361
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetComputerName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetComputerNameEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetComputerObjectName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "gethostname"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "gethostname"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::MachineName"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663361,
                                            55
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663411
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetComputerName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetComputerNameEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetComputerObjectName"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "gethostname"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "gethostname"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.Environment::MachineName"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663411,
                                            23
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "get file version info": {
            "meta": {
                "name": "get file version info",
                "namespace": "host-interaction/file-system/meta",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "File and Directory Discovery",
                        "subtechnique": "",
                        "id": "T1083"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "objective": "Discovery",
                        "behavior": "File and Directory Discovery",
                        "method": "",
                        "id": "E1083"
                    }
                ],
                "references": [],
                "examples": [
                    "mimikatz.exe_:0x45E308"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: get file version info\n    namespace: host-interaction/file-system/meta\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - mimikatz.exe_:0x45E308\n  features:\n    - and:\n      - or:\n        - api: version.GetFileVersionInfo\n        - api: version.GetFileVersionInfoEx\n        - api: System.Diagnostics.FileVersionInfo::GetVersionInfo\n      - optional:\n        - description: retrieve specified version information from the version-information resource\n        - api: version.VerQueryValue\n        - or:\n          - api: version.GetFileVersionInfoSize\n          - api: version.GetFileVersionInfoSizeEx\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663361
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "GetFileVersionInfo"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "GetFileVersionInfoEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Diagnostics.FileVersionInfo::GetVersionInfo"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663361,
                                                    13
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional",
                                        "description": "retrieve specified version information from the version-information resource"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "VerQueryValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetFileVersionInfoSize"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetFileVersionInfoSizeEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663367
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "GetFileVersionInfo"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "GetFileVersionInfoEx"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Diagnostics.FileVersionInfo::GetVersionInfo"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663367,
                                                    86
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional",
                                        "description": "retrieve specified version information from the version-information resource"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "VerQueryValue"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetFileVersionInfoSize"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetFileVersionInfoSizeEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "get MAC address in .NET": {
            "meta": {
                "name": "get MAC address in .NET",
                "namespace": "collection/network",
                "authors": [
                    "[email protected]",
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "System Information Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "System Information Discovery",
                        "subtechnique": "",
                        "id": "T1082"
                    }
                ],
                "mbc": [],
                "references": [],
                "examples": [],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: get MAC address in .NET\n    namespace: collection/network\n    authors:\n      - [email protected]\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::System Information Discovery [T1082]\n  features:\n    - or:\n      - api: System.Net.NetworkInformation.NetworkInterface::GetPhysicalAddress\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663361
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Net.NetworkInformation.NetworkInterface::GetPhysicalAddress"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663361,
                                            152
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "delete file": {
            "meta": {
                "name": "delete file",
                "namespace": "host-interaction/file-system/delete",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "File System",
                            "Delete File"
                        ],
                        "objective": "File System",
                        "behavior": "Delete File",
                        "method": "",
                        "id": "C0047"
                    }
                ],
                "references": [],
                "examples": [
                    "946A99F36A46D335DEC080D9A4371940:0x100015F0",
                    "31600AD0D1A7EA615690DF111AE36C73:0x401A15",
                    "563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001E04"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: delete file\n    namespace: host-interaction/file-system/delete\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Delete File [C0047]\n    examples:\n      - 946A99F36A46D335DEC080D9A4371940:0x100015F0\n      # MoveFileEx\n      - 31600AD0D1A7EA615690DF111AE36C73:0x401A15\n      # NtDeleteFile\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001E04\n  features:\n    - or:\n      - api: kernel32.DeleteFile\n      - api: DeleteFileTransacted\n      - api: NtDeleteFile\n      - api: ZwDeleteFile\n      - api: remove\n      - api: _wremove\n      - api: System.IO.File::Delete\n      - api: System.IO.FileSystemInfo::Delete\n      # static\n      - basic block:\n        - and:\n          - number: 3 = FO_DELETE\n          - or:\n            - api: kernel32.SHFileOperation\n      - basic block:\n        - and:\n          - number: 4 = MOVEFILE_DELAY_UNTIL_REBOOT\n          - number: 0 = NULL\n          - api: MoveFileEx\n      # dynamic\n      - call:\n        - and:\n          - number: 3 = FO_DELETE\n          - or:\n            - api: kernel32.SHFileOperation\n      - call:\n        - and:\n          - number: 4 = MOVEFILE_DELAY_UNTIL_REBOOT\n          - number: 0 = NULL\n          - api: MoveFileEx\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663362
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "DeleteFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "DeleteFileTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtDeleteFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwDeleteFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "remove"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_wremove"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Delete"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663362,
                                            142
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileSystemInfo::Delete"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "delete file/b8508890e9c046108350ab0681ec13e4"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "delete file/0906cd355c244f6da4af34f4d6744d23"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "delete file/d28e08e395a340199ee9b9c720a9e764"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "delete file/765de316f3014c918857be1fe1ff74f6"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663389
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "DeleteFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "DeleteFileTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "NtDeleteFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "ZwDeleteFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "remove"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_wremove"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Delete"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663389,
                                            3
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileSystemInfo::Delete"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "delete file/b8508890e9c046108350ab0681ec13e4"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "delete file/0906cd355c244f6da4af34f4d6744d23"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "delete file/d28e08e395a340199ee9b9c720a9e764"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "delete file/765de316f3014c918857be1fe1ff74f6"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "act as TCP client": {
            "meta": {
                "name": "act as TCP client",
                "namespace": "communication/tcp/client",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "Communication",
                            "Socket Communication",
                            "TCP Client"
                        ],
                        "objective": "Communication",
                        "behavior": "Socket Communication",
                        "method": "TCP Client",
                        "id": "C0001.008"
                    }
                ],
                "references": [],
                "examples": [
                    "Practical Malware Analysis Lab 01-01.dll_:0x10001010"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: act as TCP client\n    namespace: communication/tcp/client\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - Communication::Socket Communication::TCP Client [C0001.008]\n    examples:\n      - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n  features:\n    - or:\n      - match: connect TCP socket\n      - api: System.Net.Sockets.TcpClient::ctor\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663370
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "connect TCP socket"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Net.Sockets.TcpClient::ctor"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663370,
                                            113
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663410
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "connect TCP socket"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.Net.Sockets.TcpClient::ctor"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663410,
                                            32
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "write file on Windows": {
            "meta": {
                "name": "write file on Windows",
                "namespace": "host-interaction/file-system/write",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "File System",
                            "Writes File"
                        ],
                        "objective": "File System",
                        "behavior": "Writes File",
                        "method": "",
                        "id": "C0052"
                    }
                ],
                "references": [],
                "examples": [
                    "Practical Malware Analysis Lab 01-04.exe_:0x4011FC",
                    "563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: write file on Windows\n    namespace: host-interaction/file-system/write\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Writes File [C0052]\n    examples:\n      - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\n      # ntdll\n      - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4\n  features:\n    - or:\n      - and:\n        - os: windows\n        - optional:\n          - basic block:\n            - or:\n              - number: 0x40000000 = GENERIC_WRITE\n              - number: 0x2 = FILE_WRITE_DATA\n              - match: create or open file\n          - call:\n            - or:\n              - number: 0x40000000 = GENERIC_WRITE\n              - number: 0x2 = FILE_WRITE_DATA\n              - match: create or open file\n        - or:\n          - api: kernel32.WriteFile\n          - api: kernel32.WriteFileEx\n          - api: NtWriteFile\n          - api: ZwWriteFile\n          - api: _fwrite\n          - api: fwrite\n      - api: System.IO.File::WriteAllBytes\n      - api: System.IO.File::WriteAllBytesAsync\n      - api: System.IO.File::WriteAllLines\n      - api: System.IO.File::WriteAllLinesAsync\n      - api: System.IO.File::WriteAllText\n      - api: System.IO.File::WriteAllTextAsync\n      - api: System.IO.File::AppendAllLines\n      - api: System.IO.File::AppendAllLinesAsync\n      - api: System.IO.File::AppendAllText\n      - api: System.IO.File::AppendAllTextAsync\n      - api: System.IO.File::AppendText\n      - api: System.IO.FileInfo::AppendText\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663381
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            218
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            312
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            538
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            675
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            114
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            374
                                        ]
                                    },
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663381,
                                            448
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileInfo::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/33bb74cfc65243948fdf06cb72b21a3e"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/d5e6835277194199ad282ce2d93c0a17"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663394
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663394,
                                            42
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileInfo::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/33bb74cfc65243948fdf06cb72b21a3e"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/d5e6835277194199ad282ce2d93c0a17"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663399
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663399,
                                            83
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileInfo::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/33bb74cfc65243948fdf06cb72b21a3e"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/d5e6835277194199ad282ce2d93c0a17"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663413
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663413,
                                            268
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileInfo::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/33bb74cfc65243948fdf06cb72b21a3e"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/d5e6835277194199ad282ce2d93c0a17"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663421
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663421,
                                            134
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileInfo::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/33bb74cfc65243948fdf06cb72b21a3e"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/d5e6835277194199ad282ce2d93c0a17"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663429
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytes"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663429,
                                            331
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllBytesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::WriteAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLines"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllLinesAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendAllTextAsync"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileInfo::AppendText"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "os",
                                                "os": "windows"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "no address"
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/33bb74cfc65243948fdf06cb72b21a3e"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "match",
                                                        "match": "write file on Windows/d5e6835277194199ad282ce2d93c0a17"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "WriteFileEx"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "NtWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "ZwWriteFile"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "_fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "fwrite"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "create a process with modified I/O handles and window": {
            "meta": {
                "name": "create a process with modified I/O handles and window",
                "namespace": "host-interaction/process/create",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "Process",
                            "Create Process"
                        ],
                        "objective": "Process",
                        "behavior": "Create Process",
                        "method": "",
                        "id": "C0017"
                    }
                ],
                "references": [
                    "https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoa"
                ],
                "examples": [
                    "Practical Malware Analysis Lab 14-02.exe_:0x4011C0"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: create a process with modified I/O handles and window\n    namespace: host-interaction/process/create\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: unsupported  # requires property features\n    mbc:\n      - Process::Create Process [C0017]\n    references:\n      - https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfoa\n    examples:\n      - Practical Malware Analysis Lab 14-02.exe_:0x4011C0\n  features:\n    - or:\n      - and:\n        - or:\n          - description: API functions that accept a pointer to a STARTUPINFO structure\n          - api: kernel32.CreateProcess\n          - api: kernel32.CreateProcessInternal\n          - api: advapi32.CreateProcessAsUser\n          - api: advapi32.CreateProcessWithLogon\n          - api: advapi32.CreateProcessWithToken\n        - number: 0x101 = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW\n          # STARTF_USESTDHANDLES indicates the hStdInput, hStdOutput, and hStdError members contain additional information\n          # STARTF_USESHOWWINDOW indicates the wShowWindow member contains additional information\n        - or:\n          - and:\n            - arch: i386\n            - number: 0x44 = StartupInfo.cb (size)\n          - and:\n            - arch: amd64\n            - number: 0x68 = StartupInfo.cb (size)\n          # STARTUPINFOEX size values not currently supported by this rule.\n        - optional:\n          - api: kernel32.GetStartupInfo\n      - and:\n        - api: System.Diagnostics.Process::Start\n        - or:\n          - property/write: System.Diagnostics.ProcessStartInfo::UseShellExecute\n          - property/write: System.Diagnostics.ProcessStartInfo::Verb\n          - property/write: System.Diagnostics.ProcessStartInfo::WindowStyle\n          - property/write: System.Diagnostics.ProcessStartInfo::WorkingDirectory\n          - property/write: System.Diagnostics.ProcessStartInfo::FileName\n          - property/write: System.Diagnostics.ProcessStartInfo::Arguments\n          - property/write: System.Diagnostics.ProcessStartInfo::CreateNoWindow\n          - property/write: System.Diagnostics.ProcessStartInfo::RedirectStandardOutput\n          - property/write: System.Diagnostics.ProcessStartInfo::RedirectStandardInput\n          - property/read: System.Diagnostics.Process::StandardOutput\n          - property/read: System.Diagnostics.Process::StandardInput\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663383
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Diagnostics.Process::Start"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663383,
                                                    86
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::UseShellExecute"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::Verb"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::WindowStyle"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663383,
                                                            79
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::WorkingDirectory"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::FileName"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663383,
                                                            28
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::Arguments"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663383,
                                                            66
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::CreateNoWindow"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::RedirectStandardOutput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::RedirectStandardInput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "read",
                                                        "property": "System.Diagnostics.Process::StandardOutput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "read",
                                                        "property": "System.Diagnostics.Process::StandardInput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or",
                                                "description": "API functions that accept a pointer to a STARTUPINFO structure"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessInternal"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessAsUser"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessWithLogon"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessWithToken"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "number",
                                                "number": 257,
                                                "description": "STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "arch",
                                                                "arch": "i386"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "no address"
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 68,
                                                                "description": "StartupInfo.cb (size)"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "arch",
                                                                "arch": "amd64"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 104,
                                                                "description": "StartupInfo.cb (size)"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetStartupInfo"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663395
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Diagnostics.Process::Start"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663395,
                                                    84
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::UseShellExecute"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::Verb"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::WindowStyle"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::WorkingDirectory"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::FileName"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663395,
                                                            37
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::Arguments"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663395,
                                                            76
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::CreateNoWindow"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::RedirectStandardOutput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::RedirectStandardInput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "read",
                                                        "property": "System.Diagnostics.Process::StandardOutput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "read",
                                                        "property": "System.Diagnostics.Process::StandardInput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or",
                                                "description": "API functions that accept a pointer to a STARTUPINFO structure"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessInternal"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessAsUser"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessWithLogon"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessWithToken"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "number",
                                                "number": 257,
                                                "description": "STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "arch",
                                                                "arch": "i386"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "no address"
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 68,
                                                                "description": "StartupInfo.cb (size)"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "arch",
                                                                "arch": "amd64"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 104,
                                                                "description": "StartupInfo.cb (size)"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetStartupInfo"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ],
                [
                    {
                        "type": "dn token",
                        "value": 100663422
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Diagnostics.Process::Start"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663422,
                                                    36
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::UseShellExecute"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::Verb"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::WindowStyle"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::WorkingDirectory"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": true,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::FileName"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [
                                                    {
                                                        "type": "dn token offset",
                                                        "value": [
                                                            100663422,
                                                            29
                                                        ]
                                                    }
                                                ],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::Arguments"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::CreateNoWindow"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::RedirectStandardOutput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "write",
                                                        "property": "System.Diagnostics.ProcessStartInfo::RedirectStandardInput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "read",
                                                        "property": "System.Diagnostics.Process::StandardOutput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "property",
                                                        "access": "read",
                                                        "property": "System.Diagnostics.Process::StandardInput"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "and"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or",
                                                "description": "API functions that accept a pointer to a STARTUPINFO structure"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcess"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessInternal"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessAsUser"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessWithLogon"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "CreateProcessWithToken"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "number",
                                                "number": 257,
                                                "description": "STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "or"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": true,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "arch",
                                                                "arch": "i386"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [
                                                            {
                                                                "type": "no address"
                                                            }
                                                        ],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 68,
                                                                "description": "StartupInfo.cb (size)"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            },
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "statement",
                                                    "statement": {
                                                        "type": "and"
                                                    }
                                                },
                                                "children": [
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "arch",
                                                                "arch": "amd64"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    },
                                                    {
                                                        "success": false,
                                                        "node": {
                                                            "type": "feature",
                                                            "feature": {
                                                                "type": "number",
                                                                "number": 104,
                                                                "description": "StartupInfo.cb (size)"
                                                            }
                                                        },
                                                        "children": [],
                                                        "locations": [],
                                                        "captures": {}
                                                    }
                                                ],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "statement",
                                            "statement": {
                                                "type": "optional"
                                            }
                                        },
                                        "children": [
                                            {
                                                "success": false,
                                                "node": {
                                                    "type": "feature",
                                                    "feature": {
                                                        "type": "api",
                                                        "api": "GetStartupInfo"
                                                    }
                                                },
                                                "children": [],
                                                "locations": [],
                                                "captures": {}
                                            }
                                        ],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "get file size": {
            "meta": {
                "name": "get file size",
                "namespace": "host-interaction/file-system/meta",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "call"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "File and Directory Discovery",
                        "subtechnique": "",
                        "id": "T1083"
                    }
                ],
                "mbc": [
                    {
                        "parts": [
                            "Discovery",
                            "File and Directory Discovery"
                        ],
                        "objective": "Discovery",
                        "behavior": "File and Directory Discovery",
                        "method": "",
                        "id": "E1083"
                    }
                ],
                "references": [],
                "examples": [
                    "mimikatz.exe_:0x40630D"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: get file size\n    namespace: host-interaction/file-system/meta\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: call\n    att&ck:\n      - Discovery::File and Directory Discovery [T1083]\n    mbc:\n      - Discovery::File and Directory Discovery [E1083]\n    examples:\n      - mimikatz.exe_:0x40630D\n  features:\n    - or:\n      - api: kernel32.GetFileSize\n      - api: kernel32.GetFileSizeEx\n      - property/read: System.IO.FileInfo::Length\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663388
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetFileSize"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "GetFileSizeEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "property",
                                        "access": "read",
                                        "property": "System.IO.FileInfo::Length"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663388,
                                            62
                                        ]
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "find process by PID": {
            "meta": {
                "name": "find process by PID",
                "namespace": "host-interaction/process/list",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [
                    {
                        "parts": [
                            "Discovery",
                            "Process Discovery"
                        ],
                        "tactic": "Discovery",
                        "technique": "Process Discovery",
                        "subtechnique": "",
                        "id": "T1057"
                    }
                ],
                "mbc": [],
                "references": [],
                "examples": [
                    "493167E85E45363D09495D0841C30648:0x404B00"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: find process by PID\n    namespace: host-interaction/process/list\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    att&ck:\n      - Discovery::Process Discovery [T1057]\n    examples:\n      - 493167E85E45363D09495D0841C30648:0x404B00\n  features:\n    - and:\n      - or:\n        - api: ntoskrnl.PsLookupProcessByProcessId\n        - api: System.Diagnostics.Process::GetProcessById\n      - optional:\n        - api: ntoskrnl.ObfDereferenceObject\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663400
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "and"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "optional"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "ObfDereferenceObject"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "statement",
                                    "statement": {
                                        "type": "or"
                                    }
                                },
                                "children": [
                                    {
                                        "success": false,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "PsLookupProcessByProcessId"
                                            }
                                        },
                                        "children": [],
                                        "locations": [],
                                        "captures": {}
                                    },
                                    {
                                        "success": true,
                                        "node": {
                                            "type": "feature",
                                            "feature": {
                                                "type": "api",
                                                "api": "System.Diagnostics.Process::GetProcessById"
                                            }
                                        },
                                        "children": [],
                                        "locations": [
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663400,
                                                    37
                                                ]
                                            },
                                            {
                                                "type": "dn token offset",
                                                "value": [
                                                    100663400,
                                                    4
                                                ]
                                            }
                                        ],
                                        "captures": {}
                                    }
                                ],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "contain loop": {
            "meta": {
                "name": "contain loop",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function"
                },
                "attack": [],
                "mbc": [],
                "references": [],
                "examples": [
                    "08AC667C65D36D6542917655571E61C8:0x406EAA"
                ],
                "description": "",
                "lib": true,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: contain loop\n    authors:\n      - [email protected]\n    lib: true\n    scopes:\n      static: function\n      dynamic: unsupported  # requires characteristic features\n    examples:\n      - 08AC667C65D36D6542917655571E61C8:0x406EAA\n  features:\n    - or:\n      - characteristic: loop\n      - characteristic: tight loop\n      - characteristic: recursive call\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663414
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "characteristic",
                                        "characteristic": "loop"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "characteristic",
                                        "characteristic": "tight loop"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "characteristic",
                                        "characteristic": "recursive call"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token",
                                        "value": 100663414
                                    }
                                ],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "move file": {
            "meta": {
                "name": "move file",
                "namespace": "host-interaction/file-system/move",
                "authors": [
                    "[email protected]",
                    "[email protected]"
                ],
                "scopes": {
                    "static": "function",
                    "dynamic": "thread"
                },
                "attack": [],
                "mbc": [
                    {
                        "parts": [
                            "File System",
                            "Move File"
                        ],
                        "objective": "File System",
                        "behavior": "Move File",
                        "method": "",
                        "id": "C0063"
                    }
                ],
                "references": [],
                "examples": [
                    "Practical Malware Analysis Lab 01-04.exe_:0x401350"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: move file\n    namespace: host-interaction/file-system/move\n    authors:\n      - [email protected]\n      - [email protected]\n    scopes:\n      static: function\n      dynamic: thread\n    mbc:\n      - File System::Move File [C0063]\n    examples:\n      - Practical Malware Analysis Lab 01-04.exe_:0x401350\n  features:\n    - or:\n      - api: kernel32.MoveFile\n      - api: kernel32.MoveFileEx\n      - api: MoveFileWithProgress\n      - api: MoveFileTransacted\n      - api: rename\n      - api: _wrename\n      - api: System.IO.FileInfo::MoveTo\n      - api: System.IO.File::Move\n      - basic block:\n        - and:\n          - number: 1 = FO_MOVE\n          - or:\n            - api: kernel32.SHFileOperation\n      - call:\n        - and:\n          - number: 1 = FO_MOVE\n          - api: kernel32.SHFileOperation\n",
            "matches": [
                [
                    {
                        "type": "dn token",
                        "value": 100663423
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "MoveFile"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "MoveFileEx"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "MoveFileWithProgress"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "MoveFileTransacted"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "rename"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "_wrename"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.FileInfo::MoveTo"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "api",
                                        "api": "System.IO.File::Move"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "dn token offset",
                                        "value": [
                                            100663423,
                                            161
                                        ]
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "move file/4d05611823bd4e3ab4d7402fb37a5ccd"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "match",
                                        "match": "move file/88b2cfad634e4147be1ae4f8fff0b48f"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "compiled to the .NET platform": {
            "meta": {
                "name": "compiled to the .NET platform",
                "namespace": "runtime/dotnet",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "file",
                    "dynamic": "file"
                },
                "attack": [],
                "mbc": [],
                "references": [],
                "examples": [
                    "b9f5bd514485fb06da39beff051b9fdc"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: compiled to the .NET platform\n    namespace: runtime/dotnet\n    authors:\n      - [email protected]\n    scopes:\n      static: file\n      dynamic: file\n    examples:\n      - b9f5bd514485fb06da39beff051b9fdc\n  features:\n    - or:\n      - format: dotnet\n      - import: mscoree._CorExeMain\n      - import: mscoree._corexemain\n      - import: mscoree._CorDllMain\n      - import: mscoree._cordllmain\n",
            "matches": [
                [
                    {
                        "type": "no address"
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "statement",
                            "statement": {
                                "type": "or"
                            }
                        },
                        "children": [
                            {
                                "success": true,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "format",
                                        "format": "dotnet"
                                    }
                                },
                                "children": [],
                                "locations": [
                                    {
                                        "type": "no address"
                                    }
                                ],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "import",
                                        "import_": "mscoree._CorExeMain"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "import",
                                        "import_": "mscoree._corexemain"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "import",
                                        "import_": "mscoree._CorDllMain"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            },
                            {
                                "success": false,
                                "node": {
                                    "type": "feature",
                                    "feature": {
                                        "type": "import",
                                        "import_": "mscoree._cordllmain"
                                    }
                                },
                                "children": [],
                                "locations": [],
                                "captures": {}
                            }
                        ],
                        "locations": [],
                        "captures": {}
                    }
                ]
            ]
        },
        "contains PDB path": {
            "meta": {
                "name": "contains PDB path",
                "namespace": "executable/pe/pdb",
                "authors": [
                    "[email protected]"
                ],
                "scopes": {
                    "static": "file",
                    "dynamic": "file"
                },
                "attack": [],
                "mbc": [],
                "references": [],
                "examples": [
                    "464EF2CA59782CE697BC329713698CCC"
                ],
                "description": "",
                "lib": false,
                "is_subscope_rule": false,
                "maec": {}
            },
            "source": "rule:\n  meta:\n    name: contains PDB path\n    namespace: executable/pe/pdb\n    authors:\n      - [email protected]\n    scopes:\n      static: file\n      dynamic: file\n    examples:\n      - 464EF2CA59782CE697BC329713698CCC  # level32.exe\n  features:\n    - string: /:\\\\.*\\.pdb/\n",
            "matches": [
                [
                    {
                        "type": "no address"
                    },
                    {
                        "success": true,
                        "node": {
                            "type": "feature",
                            "feature": {
                                "type": "regex",
                                "regex": "/:\\\\.*\\.pdb/"
                            }
                        },
                        "children": [],
                        "locations": [
                            {
                                "type": "file",
                                "value": 93076
                            }
                        ],
                        "captures": {
                            "d:\\Bitlocer\\Exception from KIS\\F drive\\BINDERS\\Original OK\\Binder\\filescan\\obj\\x86\\Debug\\filescan.pdb": [
                                {
                                    "type": "file",
                                    "value": 93076
                                }
                            ]
                        }
                    }
                ]
            ]
        }
    }
}