Merge pull request #714 from mandiant/http-query-uri

add get http query uri

communication/http/client/check-http-status-code.yml

@@ -9,6 +9,7 @@ rule:
       - Communication::HTTP Communication::Read Header [C0002.014]
     examples:
       - 54ac78733552a62d1d05ea4ba3fc604bb49fe000d7fc948da45335b726e64d75:0x10001a20
+      - Practical Malware Analysis Lab 03-02.dll_:0x10004452
   features:
     - and:
       - os: windows

nursery/get-http-request-uri.yml

@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: get HTTP request URI
+    namespace: communication/http
+    authors:
+      - william.ballenthin@mandiant.com
+    scope: basic block
+    mbc:
+      - Communication::HTTP Communication [C0002]
+  features:
+    - and:
+      - api: wininet.HttpQueryInfo
+      - number: 0xD = HTTP_QUERY_URI