create or open section object

rule:
  meta:
    name: create or open section object
    authors:
      - william.ballenthin@mandiant.com
    lib: true
    scopes:
      static: function
      dynamic: thread
    examples:
      - daa13ae302fe8b618ddbf590537443ef:0x401116
  features:
    - and:
      - os: windows
      - or:
        - api: NtCreateSection
        - api: ZwCreateSection
        - api: NtOpenSection
        - api: ZwOpenSection