fix scopes for rules with subscopes 2

communication/c2/shell/create-reverse-shell.yml

@@ -6,7 +6,7 @@ rule:
       - moritz.raabe@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     att&ck:
       - Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003]
     mbc:
@@ -28,7 +28,12 @@ rule:
       - and:
         - match: create pipe
         - match: host-interaction/process/create
-        - basic block:
-          - and:
-            - count(api(SetHandleInformation)): 2 or more
-            - number: 1 = HANDLE_FLAG_INHERIT
+        - or:
+          - basic block:
+            - and:
+              - count(api(SetHandleInformation)): 2 or more
+              - number: 1 = HANDLE_FLAG_INHERIT
+          - call:
+            - and:
+              - count(api(SetHandleInformation)): 2 or more
+              - number: 1 = HANDLE_FLAG_INHERIT

communication/socket/tcp/connect-tcp-socket.yml

@@ -7,7 +7,7 @@ rule:
       - joakim@intezer.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: thread
     mbc:
       - Communication::Socket Communication::Connect Socket [C0001.004]
     examples:
@@ -20,23 +20,39 @@ rule:
         - api: ws2_32.connect
         - api: ws2_32.WSAConnect
         - api: ConnectEx
-        - and:
-          - basic block:
-            # candidate for GUID: WSAID_CONNECTEX/25a207b9-ddf3-4660-8ee9-76e58c74063e
-            - and:
-              - number: 0x25A207B9
-              - number: 0x4660DDF3
-              - number: 0xE576E98E
-              - number: 0x3E06748C
-          - basic block:
-            - and:
-              - api: WSAIoctl
-              - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER
-          - basic block:
-            - and:
-              - api: setsockopt
-              - number: 0xFFFF = SOL_SOCKET
-              - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT
-          # socket must be bound to ConnectEx
-          # https://gist.github.com/joeyadams/4158972
-          - api: bind
+        - or:
+          - and:
+            # static
+            - basic block:
+              # candidate for GUID: WSAID_CONNECTEX/25a207b9-ddf3-4660-8ee9-76e58c74063e
+              - and:
+                - number: 0x25A207B9
+                - number: 0x4660DDF3
+                - number: 0xE576E98E
+                - number: 0x3E06748C
+            - basic block:
+              - and:
+                - api: WSAIoctl
+                - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER
+            - basic block:
+              - and:
+                - api: setsockopt
+                - number: 0xFFFF = SOL_SOCKET
+                - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT
+            # socket must be bound to ConnectEx
+            # https://gist.github.com/joeyadams/4158972
+            - api: bind
+          - and:
+            # dynamic
+            - call:
+              - and:
+                - api: WSAIoctl
+                - number: 0xC8000006 = SIO_GET_EXTENSION_FUNCTION_POINTER
+            - call:
+              - and:
+                - api: setsockopt
+                - number: 0xFFFF = SOL_SOCKET
+                - number: 0x7010 = SO_UPDATE_CONNECT_CONTEXT
+            # socket must be bound to ConnectEx
+            # https://gist.github.com/joeyadams/4158972
+            - api: bind

communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml

@@ -6,7 +6,7 @@ rule:
       - william.ballenthin@mandiant.com
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains subscope
+      dynamic: unsupported
     mbc:
       - Communication::Socket Communication::Create TCP Socket [C0001.011]
     references: