rule:
  meta:
    name: create thread
    namespace: host-interaction/thread/create
    author: moritz.raabe@fireeye.com
    scope: function
    examples:
      - 946A99F36A46D335DEC080D9A4371940:0x10001DA0
  features:
    - or:
      - api: kernel32.CreateThread
      - api: _beginthread
      - api: _beginthreadex