upgrade rules using updated script

load-code/shellcode/execute-shellcode-via-copyfile2.yml

@@ -4,7 +4,9 @@ rule:
     namespace: load-code/shellcode
     authors:
       - jakub.jozwiak@mandiant.com
-    scope: function
+    scopes:
+      static: function
+      dynamic: thread
     references:
       - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CopyFile2/CopyFile2.cpp
     examples:

load-code/shellcode/execute-shellcode-via-createthreadpoolwait.yml

@@ -4,7 +4,9 @@ rule:
     namespace: load-code/shellcode
     authors:
       - jakub.jozwiak@mandiant.com
-    scope: function
+    scopes:
+      static: function
+      dynamic: thread
     references:
       - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CreateThreadPoolWait/CreateThreadPoolWait.cpp
     examples:

load-code/shellcode/execute-shellcode-via-windows-callback-function.yml

@@ -6,7 +6,9 @@ rule:
       - ervin.ocampo@mandiant.com
       - jakub.jozwiak@mandiant.com
     description: Detect usage of various WinAPI functions that accept callback functions as parameters in order to execute arbitrary shellcode
-    scope: function
+    scopes:
+      static: function
+      dynamic: thread
     att&ck:
       - Defense Evasion::Reflective Code Loading [T1620]
     mbc:

load-code/shellcode/execute-shellcode-via-windows-fibers.yml

@@ -4,7 +4,9 @@ rule:
     namespace: load-code/shellcode
     authors:
       - jakub.jozwiak@mandiant.com
-    scope: function
+    scopes:
+      static: function
+      dynamic: thread
     mbc:
       - Defense Evasion::Process Injection::Injection via Windows Fibers [E1055.m05]
     references:

load-code/shellcode/spawn-thread-to-rwx-shellcode.yml

@@ -4,7 +4,9 @@ rule:
     namespace: load-code/shellcode
     authors:
       - moritz.raabe@mandiant.com
-    scope: function
+    scopes:
+      static: function
+      dynamic: thread
     mbc:
       - Memory::Allocate Memory [C0007]
       - Process::Create Thread [C0038]