append data to CLFS log container

# generated using capa explorer for IDA Pro
rule:
  meta:
    name: append data to CLFS log container
    namespace: host-interaction/log/clfs/append
    authors:
      - blaine.stancill@mandiant.com
    scopes:
      static: function
      dynamic: thread
    references:
      - https://docs.microsoft.com/en-us/windows/win32/api/clfsw32/
      - https://github.com/libyal/libfsclfs/blob/main/documenation/Common%20Log%20File%20System%20(CLFS).asciidoc
  features:
    - and:
      - api: clfsw32.CreateLogFile
      - api: clfsw32.CreateLogMarshallingArea
      - or:
        - api: clfsw32.ReserveAndAppendLog
        - api: clfsw32.ReserveAndAppendLogAligned