Adjusts test file of hijack-thread-execution.yml, resolves conflict in inject-thread.yml and removes articles from rules

host-interaction/process/inject/hijack-thread-execution.yml

@@ -7,17 +7,17 @@ rule:
     att&ck:
       - Defense Evasion::Process Injection::Thread Execution Hijacking [T1055.003]
     examples:
-      - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:0x4044C7
+      - 77d87e9937546aebc1595039d730352b15fab32c72a76913f04262c6802d098f:0x401000
   features:
     - and:
       - optional:
         - or:
-          - match: open a thread
+          - match: open thread
           - match: create thread
-      - match: suspend a thread
+      - match: suspend thread
       - api: kernel32.GetThreadContext
       - match: allocate RWX memory
       - optional:
         - match: write process memory
       - api: kernel32.SetThreadContext
-      - match: resume a thread
+      - match: resume thread

host-interaction/process/inject/inject-dll.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: inject a dll
+    name: inject dll
     namespace: host-interaction/process/inject
     author: 0x534a@mailbox.org
     scope: function
@@ -20,7 +20,7 @@ rule:
     - and:
       - optional:
         - or:
-          - match: open a process
+          - match: open process
           - match: create process
       - match: allocate RW memory
       - match: write process memory

host-interaction/process/inject/inject-pe.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: inject a pe
+    name: inject pe
     namespace: host-interaction/process/inject
     author: 0x534a@mailbox.org
     scope: function
@@ -15,7 +15,7 @@ rule:
       - characteristic: loop
       - optional:
         - or:
-          - match: open a process
+          - match: open process
           - match: create process
       - match: allocate RWX memory
       - basic block:

host-interaction/process/inject/inject-thread.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: inject a thread
+    name: inject thread
     namespace: host-interaction/process/inject
     author: 
       - anamaria.martinezgom@fireeye.com
@@ -18,6 +18,6 @@ rule:
       - match: create thread
       - optional:
         - or:
-          - match: open a process
+          - match: open process
           - match: create process
           - number: 0x3000 = MEM_COMMIT or MEM_RESERVE

host-interaction/process/inject/use-process-replacement.yml

@@ -15,4 +15,4 @@ rule:
     - and:
       - match: create process suspended
       - match: write process memory
-      - match: resume a thread
+      - match: resume thread

host-interaction/thread/resume/resume-thread.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: resume a thread
+    name: resume thread
     namespace: host-interaction/thread/resume
     author: 0x534a@mailbox.org
     scope: basic block

host-interaction/thread/suspend/suspend-thread.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: suspend a thread
+    name: suspend thread
     namespace: host-interaction/thread/suspend
     author: 0x534a@mailbox.org
     scope: basic block

lib/open-process.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: open a process
+    name: open process
     author: 0x534a@mailbox.org
     lib: True
     scope: basic block

lib/open-thread.yml

@@ -1,6 +1,6 @@
 rule:
   meta:
-    name: open a thread
+    name: open thread
     author: 0x534a@mailbox.org
     lib: True
     scope: basic block