add-value-to-global-atom-table.yml

rule:
  meta:
    name: add value to global atom table
    namespace: host-interaction/process/inject
    authors:
      - "@mr-tz"
    scopes:
      static: function
      dynamic: thread
    references:
      - https://www.fortinet.com/blog/threat-research/atombombing-brand-new-code-injection-technique-for-windows
      - https://github.com/BreakingMalwareResearch/atom-bombing
  features:
    - and:
      - api: AddAtom
      - api: GlobalAddAtom
      - api: GlobalAddAtomEx