dynamic: "create thread bypassing process freeze" FPs #1023

[dhruvak001]

Fixes #1023

[x] No CHANGELOG update needed
[x] No new tests needed
[x] No documentation update needed

[dhruvak001]

Even though I have properly nested the code, it still reads them like:

  features:
    - and:
      - api: ntdll.NtCreateThreadEx
      properties:
        arguments:
          CreateFlags: 0x40

Instead of:

  features:
    - and:
      - api: ntdll.NtCreateThreadEx
        properties:
          arguments:
            CreateFlags: 0x40

[mr-tz]

This isn't valid rule syntax and is not something we can express unfortunately.