persist via TimeProviders registry key

rule:
  meta:
    name: persist via TimeProviders registry key
    namespace: persistence/registry
    authors:
      - j.j.vannielen@utwente.nl
    scopes:
      static: function
      dynamic: call
    att&ck:
      - Persistence::Boot or Logon Autostart Execution::Time Providers [T1547.003]
    references:
      - https://stmxcsr.com/persistence/time-provider.html
      - https://learn.microsoft.com/en-us/windows/win32/sysinfo/time-provider?redirectedfrom=MSDN
  features:
    - and:
      - match: set registry value
      - string: /System\\(CurrentControlSet|ControlSet001)\\Services\\W32Time\\TimeProviders\\/i
      - string: /^DllName$/i