flush-cabinet-file.yml

rule:
  meta:
    name: flush cabinet file
    namespace: host-interaction/file-system
    author: michael.hunhoff@fireeye.com
    scope: function
    references: https://docs.microsoft.com/en-us/windows/win32/msi/cabinet-files
  features:
    - or:
      - api: cabinet.FCIFlushFolder # flush current folder under construction
      - api: cabinet.FCIFlushCabinet # completes current cabinet