diff --git a/collection/webcam/capture-webcam-image.yml b/collection/webcam/capture-webcam-image.yml
index 987c6dfe..8783c61e 100644
--- a/collection/webcam/capture-webcam-image.yml
+++ b/collection/webcam/capture-webcam-image.yml
@@ -6,13 +6,14 @@ rule:
       - johnk3r
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Collection::Video Capture [T1125]
     examples:
       - a30101595f6f28ab2f4b0b2cd177c3c4d2ab34a355ab7761a3795d0887c24ada:0x4011C0
   features:
     - or:
+      # static
       - and:
         - api: capCreateCaptureWindow
         - basic block:
@@ -28,3 +29,19 @@ rule:
         - and:
           - api: SendMessage
           - number: 0x419 = WM_CAP_FILE_SAVEDIB
+      # dynamic
+      - and:
+        - api: capCreateCaptureWindow
+        - call:
+          - and:
+            - api: SendMessage
+            - number: 0x40a = WM_CAP_DRIVER_CONNECT
+        - optional:
+          - call:
+            - and:
+              - api: SendMessage
+              - number: 0x40B = WM_CAP_DRIVER_DISCONNECT
+      - call:
+        - and:
+          - api: SendMessage
+          - number: 0x419 = WM_CAP_FILE_SAVEDIB
diff --git a/communication/c2/shell/create-reverse-shell.yml b/communication/c2/shell/create-reverse-shell.yml
index 34c0f7aa..a05615e5 100644
--- a/communication/c2/shell/create-reverse-shell.yml
+++ b/communication/c2/shell/create-reverse-shell.yml
@@ -6,7 +6,7 @@ rule:
       - moritz.raabe@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003]
     mbc:
@@ -28,7 +28,12 @@ rule:
       - and:
         - match: create pipe
         - match: host-interaction/process/create
-        - basic block:
-          - and:
-            - count(api(SetHandleInformation)): 2 or more
-            - number: 1 = HANDLE_FLAG_INHERIT
+        - or:
+          - basic block:
+            - and:
+              - count(api(SetHandleInformation)): 2 or more
+              - number: 1 = HANDLE_FLAG_INHERIT
+          - call:
+            - and:
+              - count(api(SetHandleInformation)): 2 or more
+              - number: 1 = HANDLE_FLAG_INHERIT
diff --git a/communication/socket/tcp/connect-tcp-socket.yml b/communication/socket/tcp/connect-tcp-socket.yml
index 312f975b..2dd7df61 100644
--- a/communication/socket/tcp/connect-tcp-socket.yml
+++ b/communication/socket/tcp/connect-tcp-socket.yml
@@ -7,7 +7,7 @@ rule:
       - joakim@intezer.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - Communication::Socket Communication::Connect Socket [C0001.004]
     examples:
@@ -20,23 +20,39 @@ rule:
         - api: ws2_32.connect
         - api: ws2_32.WSAConnect
         - api: ConnectEx
-        - and:
-          - basic block:
-            # candidate for GUID: WSAID_CONNECTEX/25a207b9-ddf3-4660-8ee9-76e58c74063e
-            - and:
-              - number: 0x25A207B9
-              - number: 0x4660DDF3
-              - number: 0xE576E98E
-              - number: 0x3E06748C
-          - basic block:
-            - and:
-              - api: WSAIoctl
-              - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER
-          - basic block:
-            - and:
-              - api: setsockopt
-              - number: 0xFFFF = SOL_SOCKET
-              - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT
-          # socket must be bound to ConnectEx
-          # https://gist.github.com/joeyadams/4158972
-          - api: bind
+        - or:
+          - and:
+            # static
+            - basic block:
+              # candidate for GUID: WSAID_CONNECTEX/25a207b9-ddf3-4660-8ee9-76e58c74063e
+              - and:
+                - number: 0x25A207B9
+                - number: 0x4660DDF3
+                - number: 0xE576E98E
+                - number: 0x3E06748C
+            - basic block:
+              - and:
+                - api: WSAIoctl
+                - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER
+            - basic block:
+              - and:
+                - api: setsockopt
+                - number: 0xFFFF = SOL_SOCKET
+                - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT
+            # socket must be bound to ConnectEx
+            # https://gist.github.com/joeyadams/4158972
+            - api: bind
+          - and:
+            # dynamic
+            - call:
+              - and:
+                - api: WSAIoctl
+                - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER
+            - call:
+              - and:
+                - api: setsockopt
+                - number: 0xFFFF = SOL_SOCKET
+                - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT
+            # socket must be bound to ConnectEx
+            # https://gist.github.com/joeyadams/4158972
+            - api: bind
diff --git a/communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml b/communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml
index ee02f8cc..03510fd7 100644
--- a/communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml
+++ b/communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml
@@ -6,7 +6,7 @@ rule:
       - william.ballenthin@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: unsupported
     mbc:
       - Communication::Socket Communication::Create TCP Socket [C0001.011]
     references:
diff --git a/compiler/perl2exe/compiled-with-perl2exe.yml b/compiler/perl2exe/compiled-with-perl2exe.yml
index b0e667c9..b8724e47 100644
--- a/compiler/perl2exe/compiled-with-perl2exe.yml
+++ b/compiler/perl2exe/compiled-with-perl2exe.yml
@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     examples:
       - 873275ce8bf88ef66e9fa0c74b5c2a1e:0x4011C9
   features:
@@ -14,7 +14,12 @@ rule:
       - api: LoadLibrary
       - api: FreeLibrary
       - string: /^p2x[a-z0-9]{1,10}\.dll/i
-      - basic block:
-        - and:
-          - api: GetProcAddress
-          - string: "RunPerl"
+      - or:
+        - basic block:
+          - and:
+            - api: GetProcAddress
+            - string: "RunPerl"
+        - call:
+          - and:
+            - api: GetProcAddress
+            - string: "RunPerl"
diff --git a/data-manipulation/compression/decompress-data-using-quicklz.yml b/data-manipulation/compression/decompress-data-using-quicklz.yml
index 5272a17a..b8bf22b0 100644
--- a/data-manipulation/compression/decompress-data-using-quicklz.yml
+++ b/data-manipulation/compression/decompress-data-using-quicklz.yml
@@ -7,7 +7,7 @@ rule:
     description: detects the inner decompression loop from QuickLZ
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: unsupported
     mbc:
       - Data::Decompress Data::QuickLZ [C0025.001]
     references:
diff --git a/data-manipulation/hashing/hash-data-via-wincrypt.yml b/data-manipulation/hashing/hash-data-via-wincrypt.yml
index 6402d0af..d84ae236 100644
--- a/data-manipulation/hashing/hash-data-via-wincrypt.yml
+++ b/data-manipulation/hashing/hash-data-via-wincrypt.yml
@@ -6,7 +6,7 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - Cryptography::Cryptographic Hash [C0029]
     examples:
@@ -22,3 +22,10 @@ rule:
               - number: 1 = HP_ALGID
               - number: 2 = HP_HASHVAL
               - number: 4 = HP_HASHSIZE
+        - call:
+          - and:
+            - api: advapi32.CryptGetHashParam
+            - or:
+              - number: 1 = HP_ALGID
+              - number: 2 = HP_HASHVAL
+              - number: 4 = HP_HASHSIZE
diff --git a/data-manipulation/hashing/sha1/hash-data-using-sha1.yml b/data-manipulation/hashing/sha1/hash-data-using-sha1.yml
index 76a8cbbe..35503c97 100644
--- a/data-manipulation/hashing/sha1/hash-data-using-sha1.yml
+++ b/data-manipulation/hashing/sha1/hash-data-using-sha1.yml
@@ -8,7 +8,7 @@ rule:
       - william.ballenthin@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - Cryptography::Cryptographic Hash::SHA1 [C0029.002]
     examples:
@@ -32,6 +32,10 @@ rule:
         - and:
           - number: 0x8004 = CALG_SHA1
           - api: advapi32.CryptCreateHash
+      - call:
+        - and:
+          - number: 0x8004 = CALG_SHA1
+          - api: advapi32.CryptCreateHash
       - and:
         - api: System.Security.Cryptography.SHA1Managed::ctor
         - optional:
diff --git a/host-interaction/clipboard/read-clipboard-data.yml b/host-interaction/clipboard/read-clipboard-data.yml
index 14f30d66..37ae798a 100644
--- a/host-interaction/clipboard/read-clipboard-data.yml
+++ b/host-interaction/clipboard/read-clipboard-data.yml
@@ -7,7 +7,7 @@ rule:
       - anushka.virgaonkar@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Collection::Clipboard Data [T1115]
     references:
@@ -31,6 +31,13 @@ rule:
               - number: 0x1 = CF_TEXT
               - number: 0x7 = CF_OEMTEXT
               - number: 0xD = CF_UNICODETEXT
+        - call:
+          - and:
+            - api: user32.GetClipboardData
+            - optional:
+              - number: 0x1 = CF_TEXT
+              - number: 0x7 = CF_OEMTEXT
+              - number: 0xD = CF_UNICODETEXT
         - api: System.Windows.Forms.Clipboard::GetAudioStream
         - api: System.Windows.Forms.Clipboard::GetData
         - api: System.Windows.Forms.Clipboard::GetDataObject
diff --git a/host-interaction/file-system/copy/copy-file.yml b/host-interaction/file-system/copy/copy-file.yml
index 5040e739..ff047b0e 100644
--- a/host-interaction/file-system/copy/copy-file.yml
+++ b/host-interaction/file-system/copy/copy-file.yml
@@ -7,7 +7,7 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - File System::Copy File [C0045]
     examples:
@@ -26,3 +26,8 @@ rule:
           - number: 2 = FO_COPY
           - or:
             - api: kernel32.SHFileOperation
+      - call:
+        - and:
+          - number: 2 = FO_COPY
+          - or:
+            - api: kernel32.SHFileOperation
diff --git a/host-interaction/file-system/delete/delete-file.yml b/host-interaction/file-system/delete/delete-file.yml
index 81c4494d..2e945c9d 100644
--- a/host-interaction/file-system/delete/delete-file.yml
+++ b/host-interaction/file-system/delete/delete-file.yml
@@ -7,7 +7,7 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - File System::Delete File [C0047]
     examples:
@@ -26,6 +26,7 @@ rule:
       - api: _wremove
       - api: System.IO.File::Delete
       - api: System.IO.FileSystemInfo::Delete
+      # static
       - basic block:
         - and:
           - number: 3 = FO_DELETE
@@ -36,3 +37,14 @@ rule:
           - number: 4 = MOVEFILE_DELAY_UNTIL_REBOOT
           - number: 0 = NULL
           - api: MoveFileEx
+      # dynamic
+      - call:
+        - and:
+          - number: 3 = FO_DELETE
+          - or:
+            - api: kernel32.SHFileOperation
+      - call:
+        - and:
+          - number: 4 = MOVEFILE_DELAY_UNTIL_REBOOT
+          - number: 0 = NULL
+          - api: MoveFileEx
diff --git a/host-interaction/file-system/exists/check-if-file-exists.yml b/host-interaction/file-system/exists/check-if-file-exists.yml
index fd2d5f10..8a98ca56 100644
--- a/host-interaction/file-system/exists/check-if-file-exists.yml
+++ b/host-interaction/file-system/exists/check-if-file-exists.yml
@@ -7,7 +7,7 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: unsupported  # TODO dynamic scope could be adjusted
     att&ck:
       - Discovery::File and Directory Discovery [T1083]
     mbc:
diff --git a/host-interaction/file-system/files/list/enumerate-files-on-windows.yml b/host-interaction/file-system/files/list/enumerate-files-on-windows.yml
index c5c495b9..5922183a 100644
--- a/host-interaction/file-system/files/list/enumerate-files-on-windows.yml
+++ b/host-interaction/file-system/files/list/enumerate-files-on-windows.yml
@@ -7,7 +7,7 @@ rule:
       - anushka.virgaonkar@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Discovery::File and Directory Discovery [T1083]
     mbc:
@@ -34,10 +34,15 @@ rule:
           - api: kernel32.FindClose
           - match: contain loop
       - and:
-        - basic block:
-          - and:
-            - number: 1 = DIRECTORY_QUERY
-            - api: ntdll.NtOpenDirectoryObject
+        - or:
+          - basic block:
+            - and:
+              - number: 1 = DIRECTORY_QUERY
+              - api: ntdll.NtOpenDirectoryObject
+          - call:
+            - and:
+              - number: 1 = DIRECTORY_QUERY
+              - api: ntdll.NtOpenDirectoryObject
         - api: ntdll.NtQueryDirectoryObject
         - optional:
           - api: RtlAllocateHeap
diff --git a/host-interaction/file-system/move/move-file.yml b/host-interaction/file-system/move/move-file.yml
index 8564ee8c..757bcf34 100644
--- a/host-interaction/file-system/move/move-file.yml
+++ b/host-interaction/file-system/move/move-file.yml
@@ -7,7 +7,7 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - File System::Move File [C0063]
     examples:
@@ -27,3 +27,7 @@ rule:
           - number: 1 = FO_MOVE
           - or:
             - api: kernel32.SHFileOperation
+      - call:
+        - and:
+          - number: 1 = FO_MOVE
+          - api: kernel32.SHFileOperation
diff --git a/host-interaction/file-system/read/read-file-via-mapping.yml b/host-interaction/file-system/read/read-file-via-mapping.yml
index dc4ef966..41de967f 100644
--- a/host-interaction/file-system/read/read-file-via-mapping.yml
+++ b/host-interaction/file-system/read/read-file-via-mapping.yml
@@ -6,13 +6,14 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - File System::Read File [C0051]
     examples:
       - Practical Malware Analysis Lab 01-01.exe_:0x401440
   features:
     - and:
+      # static
       - basic block:
         - and:
           - api: kernel32.MapViewOfFile
@@ -29,3 +30,20 @@ rule:
             - or:
               - number: 2 = PAGE_READONLY
               - number: 4 = PAGE_READWRITE
+      # dynamic
+      - call:
+        - and:
+          - api: kernel32.MapViewOfFile
+          - or:
+            - number: 4 = FILE_MAP_READ
+            - number: 6 = FILE_MAP_WRITE | FILE_MAP_READ
+      - optional:
+        - api: kernel32.UnmapViewOfFile
+        - and:
+          - match: get file size
+        - call:
+          - and:
+            - api: kernel32.CreateFileMapping
+            - or:
+              - number: 2 = PAGE_READONLY
+              - number: 4 = PAGE_READWRITE
diff --git a/host-interaction/file-system/write/write-file-on-windows.yml b/host-interaction/file-system/write/write-file-on-windows.yml
index cc9e7525..d1cd4c8b 100644
--- a/host-interaction/file-system/write/write-file-on-windows.yml
+++ b/host-interaction/file-system/write/write-file-on-windows.yml
@@ -7,7 +7,7 @@ rule:
       - anushka.virgaonkar@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - File System::Writes File [C0052]
     examples:
@@ -24,6 +24,11 @@ rule:
               - number: 0x40000000 = GENERIC_WRITE
               - number: 0x2 = FILE_WRITE_DATA
               - match: create or open file
+          - call:
+            - or:
+              - number: 0x40000000 = GENERIC_WRITE
+              - number: 0x2 = FILE_WRITE_DATA
+              - match: create or open file
         - or:
           - api: kernel32.WriteFile
           - api: kernel32.WriteFileEx
diff --git a/host-interaction/gui/window/get-text/get-graphical-window-text.yml b/host-interaction/gui/window/get-text/get-graphical-window-text.yml
index f7f25a04..2dd99b57 100644
--- a/host-interaction/gui/window/get-text/get-graphical-window-text.yml
+++ b/host-interaction/gui/window/get-text/get-graphical-window-text.yml
@@ -6,7 +6,7 @@ rule:
       - moritz.raabe@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - Discovery::Application Window Discovery [E1010]
     examples:
@@ -17,10 +17,15 @@ rule:
       - and:
         - optional:
           - api: user32.IsWindowVisible
-        - basic block:
-          - and:
-            - number: 0xD = WM_GETTEXT
-            - api: user32.SendMessage
+        - or:
+          - basic block:
+            - and:
+              - number: 0xD = WM_GETTEXT
+              - api: user32.SendMessage
+          - call:
+            - and:
+              - number: 0xD = WM_GETTEXT
+              - api: user32.SendMessage
       - and:
         - optional:
           - api: user32.GetForegroundWindow
diff --git a/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml b/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml
index 4264488f..794d2000 100644
--- a/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml
+++ b/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml
@@ -7,7 +7,7 @@ rule:
       - johnk3r
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - Hardware::Simulate Hardware::Ctrl-Alt-Del [C0057.001]
     examples:
@@ -21,9 +21,22 @@ rule:
               - api: OpenDesktop
               - api: OpenInputDesktop
             - string: "Winlogon"
-      - basic block:
-        - and:
-          - api: PostMessage
-          - number: 0x2E0003 = (MOD_ALT | MOD_CONTROL | VK_DELETE)
-          - number: 0x312 = WM_HOTKEY
-          - number: 0xFFFF = HWND_BROADCAST
+        - call:
+          - and:
+            - or:
+              - api: OpenDesktop
+              - api: OpenInputDesktop
+            - string: "Winlogon"
+      - or:
+        - basic block:
+          - and:
+            - api: PostMessage
+            - number: 0x2E0003 = (MOD_ALT | MOD_CONTROL | VK_DELETE)
+            - number: 0x312 = WM_HOTKEY
+            - number: 0xFFFF = HWND_BROADCAST
+        - call:
+          - and:
+            - api: PostMessage
+            - number: 0x2E0003 = (MOD_ALT | MOD_CONTROL | VK_DELETE)
+            - number: 0x312 = WM_HOTKEY
+            - number: 0xFFFF = HWND_BROADCAST
diff --git a/host-interaction/hardware/storage/get-disk-size.yml b/host-interaction/hardware/storage/get-disk-size.yml
index c5198c86..ab314cd5 100644
--- a/host-interaction/hardware/storage/get-disk-size.yml
+++ b/host-interaction/hardware/storage/get-disk-size.yml
@@ -7,7 +7,7 @@ rule:
       - anushka.virgaonkar@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Discovery::System Information Discovery [T1082]
     mbc:
@@ -28,6 +28,10 @@ rule:
         - and:
           - api: DeviceIoControl
           - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO
+      - call:
+        - and:
+          - api: DeviceIoControl
+          - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO
       - and:
         - or:
           - string: /SELECT\s+\*\s+FROM\s+Win32_LogicalDisk/i
diff --git a/host-interaction/process/inject/allocate-or-change-rwx-memory.yml b/host-interaction/process/inject/allocate-or-change-rwx-memory.yml
index 1b5fdcb9..1393a89d 100644
--- a/host-interaction/process/inject/allocate-or-change-rwx-memory.yml
+++ b/host-interaction/process/inject/allocate-or-change-rwx-memory.yml
@@ -6,7 +6,7 @@ rule:
       - "@mr-tz"
     scopes:
       static: basic block
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - Memory::Allocate Memory [C0007]
     examples:
diff --git a/host-interaction/process/list/enumerate-processes.yml b/host-interaction/process/list/enumerate-processes.yml
index 3325a93f..d790b129 100644
--- a/host-interaction/process/list/enumerate-processes.yml
+++ b/host-interaction/process/list/enumerate-processes.yml
@@ -7,7 +7,7 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Discovery::Process Discovery [T1057]
       - Discovery::Software Discovery [T1518]
@@ -27,3 +27,9 @@ rule:
                 - number: 0xF = TH32CS_SNAPALL
                 - number: 0x2 = TH32CS_SNAPPROCESS
               - api: kernel32.CreateToolhelp32Snapshot
+          - call:
+            - and:
+              - or:
+                - number: 0xF = TH32CS_SNAPALL
+                - number: 0x2 = TH32CS_SNAPPROCESS
+              - api: kernel32.CreateToolhelp32Snapshot
diff --git a/host-interaction/process/modules/list/enumerate-process-modules.yml b/host-interaction/process/modules/list/enumerate-process-modules.yml
index 4a4db4e1..10ee51ca 100644
--- a/host-interaction/process/modules/list/enumerate-process-modules.yml
+++ b/host-interaction/process/modules/list/enumerate-process-modules.yml
@@ -7,7 +7,7 @@ rule:
       - anushka.virgaonkar@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Discovery::Process Discovery [T1057]
     examples:
@@ -39,6 +39,13 @@ rule:
                 - number: 0x10 = TH32CS_SNAPMODULE32
                 - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32
               - api: kernel32.CreateToolhelp32Snapshot
+          - call:
+            - and:
+              - or:
+                - number: 0x8 = TH32CS_SNAPMODULE
+                - number: 0x10 = TH32CS_SNAPMODULE32
+                - number: 0x18 = TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32
+              - api: kernel32.CreateToolhelp32Snapshot
       - and:
         - property/read: System.Diagnostics.Process::Modules
         - property/read: System.Diagnostics.ProcessModuleCollection::Item
diff --git a/host-interaction/service/continue-service.yml b/host-interaction/service/continue-service.yml
index 2d1e5f62..5715989a 100644
--- a/host-interaction/service/continue-service.yml
+++ b/host-interaction/service/continue-service.yml
@@ -6,7 +6,7 @@ rule:
       - "@mr-tz"
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Persistence::Create or Modify System Process::Windows Service [T1543.003]
     examples:
@@ -15,9 +15,16 @@ rule:
     - and:
       - optional:
         - match: get service handle
-      - basic block:
-        - and:
-          - number: 0x3 = SERVICE_CONTROL_CONTINUE
-          - or:
-            - api: advapi32.ControlService
-            - api: advapi32.ControlServiceEx
+      - or:
+        - basic block:
+          - and:
+            - number: 0x3 = SERVICE_CONTROL_CONTINUE
+            - or:
+              - api: advapi32.ControlService
+              - api: advapi32.ControlServiceEx
+        - call:
+          - and:
+            - number: 0x3 = SERVICE_CONTROL_CONTINUE
+            - or:
+              - api: advapi32.ControlService
+              - api: advapi32.ControlServiceEx
diff --git a/host-interaction/service/pause-service.yml b/host-interaction/service/pause-service.yml
index 9a0350dd..c4667131 100644
--- a/host-interaction/service/pause-service.yml
+++ b/host-interaction/service/pause-service.yml
@@ -6,7 +6,7 @@ rule:
       - "@mr-tz"
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Persistence::Create or Modify System Process::Windows Service [T1543.003]
     examples:
@@ -15,9 +15,16 @@ rule:
     - and:
       - optional:
         - match: get service handle
-      - basic block:
-        - and:
-          - number: 0x2 = SERVICE_CONTROL_PAUSE
-          - or:
-            - api: advapi32.ControlService
-            - api: advapi32.ControlServiceEx
+      - or:
+        - basic block:
+          - and:
+            - number: 0x2 = SERVICE_CONTROL_PAUSE
+            - or:
+              - api: advapi32.ControlService
+              - api: advapi32.ControlServiceEx
+        - call:
+          - and:
+            - number: 0x2 = SERVICE_CONTROL_PAUSE
+            - or:
+              - api: advapi32.ControlService
+              - api: advapi32.ControlServiceEx
diff --git a/host-interaction/service/stop/stop-service.yml b/host-interaction/service/stop/stop-service.yml
index 9caa6d57..dcd6ebac 100644
--- a/host-interaction/service/stop/stop-service.yml
+++ b/host-interaction/service/stop/stop-service.yml
@@ -6,7 +6,7 @@ rule:
       - moritz.raabe@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Persistence::Create or Modify System Process::Windows Service [T1543.003]
       - Impact::Service Stop [T1489]
@@ -16,9 +16,16 @@ rule:
     - and:
       - optional:
         - match: get service handle
-      - basic block:
-        - and:
-          - number: 0x1 = SERVICE_CONTROL_STOP
-          - or:
-            - api: advapi32.ControlService
-            - api: advapi32.ControlServiceEx
+      - or:
+        - basic block:
+          - and:
+            - number: 0x1 = SERVICE_CONTROL_STOP
+            - or:
+              - api: advapi32.ControlService
+              - api: advapi32.ControlServiceEx
+        - call:
+          - and:
+            - number: 0x1 = SERVICE_CONTROL_STOP
+            - or:
+              - api: advapi32.ControlService
+              - api: advapi32.ControlServiceEx
diff --git a/host-interaction/session/get-session-user-name.yml b/host-interaction/session/get-session-user-name.yml
index 685652d1..f9673dfb 100644
--- a/host-interaction/session/get-session-user-name.yml
+++ b/host-interaction/session/get-session-user-name.yml
@@ -7,7 +7,7 @@ rule:
       - anushka.virgaonkar@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Discovery::System Owner/User Discovery [T1033]
       - Discovery::Account Discovery [T1087]
@@ -22,5 +22,9 @@ rule:
           # - match: get session information (see #463)
           - api: wtsapi32.WTSQuerySessionInformation
           - number: 5 = WTSUserName
+      - call:
+        - and:
+          - api: wtsapi32.WTSQuerySessionInformation
+          - number: 5 = WTSUserName
       - api: System.Security.Principal.WindowsIdentity::GetCurrent
       - property/read: System.Environment::UserName
diff --git a/host-interaction/thread/list/enumerate-threads.yml b/host-interaction/thread/list/enumerate-threads.yml
index c445f568..cdf6ddf5 100644
--- a/host-interaction/thread/list/enumerate-threads.yml
+++ b/host-interaction/thread/list/enumerate-threads.yml
@@ -6,7 +6,7 @@ rule:
       - moritz.raabe@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Discovery::Process Discovery [T1057]
     mbc:
@@ -24,3 +24,8 @@ rule:
               - number: 0x4 = TH32CS_SNAPTHREAD
               # TH32CS_SNAPTHREAD includes all threads in the system in the snapshot
             - api: kernel32.CreateToolhelp32Snapshot
+        - call:
+          - and:
+            - or:
+              - number: 0x4 = TH32CS_SNAPTHREAD
+            - api: kernel32.CreateToolhelp32Snapshot
diff --git a/lib/allocate-or-change-rw-memory.yml b/lib/allocate-or-change-rw-memory.yml
index bd304b72..4d2b2d06 100644
--- a/lib/allocate-or-change-rw-memory.yml
+++ b/lib/allocate-or-change-rw-memory.yml
@@ -7,7 +7,7 @@ rule:
     lib: true
     scopes:
       static: basic block
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - Memory::Allocate Memory [C0007]
     examples:
diff --git a/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml b/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml
index e55293a6..807f4b8d 100644
--- a/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml
+++ b/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml
@@ -7,7 +7,7 @@ rule:
     description: Custom API hashing algorithm used in Brute Ratel Badger (version 1.3 or higher)
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: unsupported
     att&ck:
       - Defense Evasion::Obfuscated Files or Information::Dynamic API Resolution [T1027.007]
     mbc:
diff --git a/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml b/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml
index a181ce87..a4c9f239 100644
--- a/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml
+++ b/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml
@@ -7,7 +7,7 @@ rule:
     description: APIHashing algorithm derived from a fasthash implementation in OpenCPN using seeds
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: unsupported
     mbc:
       - Cryptography::Cryptographic Hash [C0029]
     references:
diff --git a/nursery/capture-webcam-video.yml b/nursery/capture-webcam-video.yml
index 5f25248b..e1dd86c5 100644
--- a/nursery/capture-webcam-video.yml
+++ b/nursery/capture-webcam-video.yml
@@ -7,23 +7,42 @@ rule:
     description: Rule that detects a system's webcam being used to capture video
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Collection::Video Capture [T1125]
   features:
-    - and:
-      - os: windows
-      - api: capCreateCaptureWindow
-      - basic block:
-        - and:
-          - api: SendMessage
-          - number: 0x43E = WM_CAP_SEQUENCE
-      - or:
+    - or:
+      # static
+      - and:
+        - os: windows
+        - api: capCreateCaptureWindow
         - basic block:
           - and:
             - api: SendMessage
-            - number: 0x417 = WM_CAP_FILE_SAVEAS
-        - basic block:
+            - number: 0x43E = WM_CAP_SEQUENCE
+        - or:
+          - basic block:
+            - and:
+              - api: SendMessage
+              - number: 0x417 = WM_CAP_FILE_SAVEAS
+          - basic block:
+            - and:
+              - api: SendMessage
+              - number: 0x414 = WM_CAP_FILE_SET_CAPTURE_FILE
+      # dynamic
+      - and:
+        - os: windows
+        - api: capCreateCaptureWindow
+        - call:
           - and:
             - api: SendMessage
-            - number: 0x414 = WM_CAP_FILE_SET_CAPTURE_FILE
+            - number: 0x43E = WM_CAP_SEQUENCE
+        - or:
+          - call:
+            - and:
+              - api: SendMessage
+              - number: 0x417 = WM_CAP_FILE_SAVEAS
+          - call:
+            - and:
+              - api: SendMessage
+              - number: 0x414 = WM_CAP_FILE_SET_CAPTURE_FILE
diff --git a/nursery/check-for-process-debug-object.yml b/nursery/check-for-process-debug-object.yml
index 2b1c941a..ba44d8c1 100644
--- a/nursery/check-for-process-debug-object.yml
+++ b/nursery/check-for-process-debug-object.yml
@@ -6,7 +6,7 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - Anti-Behavioral Analysis::Debugger Detection::NtQueryInformationProcess [B0001.012]
     references:
@@ -16,9 +16,16 @@ rule:
       - or:
         - api: kernel32.GetCurrentProcess
         - api: System.Diagnostics.Process::GetCurrentProcess
-      - basic block:
-        - and:
-          - or:
-            - api: NtQueryInformationProcess
-            - api: ZwQueryInformationProcess
-          - number: 0x1E = ProcessDebugObjectHandle
+      - or:
+        - basic block:
+          - and:
+            - or:
+              - api: NtQueryInformationProcess
+              - api: ZwQueryInformationProcess
+            - number: 0x1E = ProcessDebugObjectHandle
+        - call:
+          - and:
+            - or:
+              - api: NtQueryInformationProcess
+              - api: ZwQueryInformationProcess
+            - number: 0x1E = ProcessDebugObjectHandle
diff --git a/nursery/check-for-sandbox-via-mac-address-ouis-in-dotnet.yml b/nursery/check-for-sandbox-via-mac-address-ouis-in-dotnet.yml
index e18528f9..ed99d449 100644
--- a/nursery/check-for-sandbox-via-mac-address-ouis-in-dotnet.yml
+++ b/nursery/check-for-sandbox-via-mac-address-ouis-in-dotnet.yml
@@ -7,7 +7,7 @@ rule:
     description: detects sandbox detection via mac address organizationally unique identifiers (OUIs). Based off publicly available CSharpShooter/CheckPlease.cs
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: unsupported
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:
diff --git a/nursery/get-token-privileges.yml b/nursery/get-token-privileges.yml
index 6029ebd4..bc64f7de 100644
--- a/nursery/get-token-privileges.yml
+++ b/nursery/get-token-privileges.yml
@@ -7,12 +7,17 @@ rule:
       - michael.hunhoff@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
   features:
     - and:
-      - basic block:
-        - and:
-          - api: advapi32.GetTokenInformation
-          - number: 0x3 = TokenPrivileges
+      - or:
+        - basic block:
+          - and:
+            - api: advapi32.GetTokenInformation
+            - number: 0x3 = TokenPrivileges
+        - call:
+          - and:
+            - api: advapi32.GetTokenInformation
+            - number: 0x3 = TokenPrivileges
       - optional:
         - api: advapi32.LookupPrivilegeName
diff --git a/nursery/hash-data-using-ripemd128.yml b/nursery/hash-data-using-ripemd128.yml
index 74773635..05c5d029 100755
--- a/nursery/hash-data-using-ripemd128.yml
+++ b/nursery/hash-data-using-ripemd128.yml
@@ -6,7 +6,7 @@ rule:
       - raymond.leong@mandiant.com
     scopes:
       static: file
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: unsupported
     references:
       - https://en.wikipedia.org/wiki/RIPEMD-128
   features:
diff --git a/persistence/service/persist-via-windows-service.yml b/persistence/service/persist-via-windows-service.yml
index f9fb7484..041e2425 100644
--- a/persistence/service/persist-via-windows-service.yml
+++ b/persistence/service/persist-via-windows-service.yml
@@ -6,7 +6,7 @@ rule:
       - moritz.raabe@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Persistence::Create or Modify System Process::Windows Service [T1543.003]
       - Execution::System Services::Service Execution [T1569.002]
@@ -16,10 +16,15 @@ rule:
   features:
     - or:
       - and:
-        - basic block:
-          - and:
-            - number: 2 = SERVICE_AUTO_START
-            - api: advapi32.CreateService
+        - or:
+          - basic block:
+            - and:
+              - number: 2 = SERVICE_AUTO_START
+              - api: advapi32.CreateService
+          - call:
+            - and:
+              - number: 2 = SERVICE_AUTO_START
+              - api: advapi32.CreateService
         - optional:
           - or:
             - api: advapi32.OpenService