allocate thread local storage

rule:
  meta:
    name: allocate thread local storage
    namespace: host-interaction/thread/tls
    authors:
      - michael.hunhoff@mandiant.com
    scopes:
      static: function
      dynamic: call
    mbc:
      - Process::Allocate Thread Local Storage [C0040]
    examples:
      - 03B236B23B1EC37C663527C1F53AF3FE:0x18000ADF6
  features:
    - or:
      - api: kernel32.TlsAlloc