capa-rules/communication/c2/shell
Willi Ballenthin c1d20764ad
use "span of calls" scope (#973)
* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>

---------

Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2025-01-29 10:27:13 +01:00
..
create-reverse-shell-on-linux.yml use "span of calls" scope (#973) 2025-01-29 10:27:13 +01:00
create-reverse-shell.yml use "span of calls" scope (#973) 2025-01-29 10:27:13 +01:00
execute-shell-command-and-capture-output.yml use "span of calls" scope (#973) 2025-01-29 10:27:13 +01:00
execute-shell-command-received-from-socket-on-linux.yml use "span of calls" scope (#973) 2025-01-29 10:27:13 +01:00