diff --git a/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml b/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml
index e6ccaa07..65614828 100644
--- a/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml
+++ b/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml
@@ -6,7 +6,7 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Defense Evasion::Disable or Evade Security Tools::Bypass Windows File Protection [F0004.007]
     examples: