use "span of calls" scope (#973)

* use sequence scope instead of thread scope for "static: function" rules

* use sequence scope instead of thread scope for "static: basic block" rules

* make runtime linking rules more concise

* doc: describe sequence scope

* rename "sequence" scope to "span of calls" scope

* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/get-geographical-location.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/file-managers/gather-classicftp-information.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/database/wmi/reference-wmi-statements.yml

Co-authored-by: Mike Hunhoff <[email protected]>

* Update collection/database/sql/reference-sql-statements.yml

Co-authored-by: Mike Hunhoff <[email protected]>

---------

Co-authored-by: Mike Hunhoff <[email protected]>

README.md

@@ -31,7 +31,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003]
     mbc:

anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: basic block
-      dynamic: thread
+      dynamic: call
     mbc:
       - Anti-Behavioral Analysis::Virtual Machine Detection [B0009]
       - Anti-Behavioral Analysis::Sandbox Detection [B0007]

anti-analysis/anti-av/overwrite-dll-text-section-to-remove-hooks.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
     mbc:

anti-analysis/anti-av/patch-antimalware-scan-interface-function.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
     mbc:

anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
     mbc:

anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: basic block
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]
     examples:

anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]
     references:

anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033]
     examples:

anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Anti-Behavioral Analysis::Debugger Detection [B0001]
     references:

anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml

@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Debugger Evasion [T1622]
     mbc:

anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:

anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Indicator Removal::Clear Windows Event Logs [T1070.001]
     examples:

anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: basic block
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Impair Defenses::Disable Windows Event Logging [T1562.002]
     references:

anti-analysis/anti-forensic/impersonate-file-version-information.yml

@@ -7,7 +7,7 @@ rule:
     description: Looks for Windows API calls associated with reading and then writing file version information of executables on disk. Malware can use these calls to overwrite its own version information with that of a legitimate executable on the system (for instance, explorer.exe) to make it appear to be a legitimate application.
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Indicator Removal [T1070]
     references:

anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Indicator Removal::File Deletion [T1070.004]
     mbc:

anti-analysis/anti-forensic/self-deletion/self-delete.yml

@@ -7,7 +7,7 @@ rule:
       - "@mr-tz"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Indicator Removal::File Deletion [T1070.004]
     mbc:

anti-analysis/anti-forensic/timestomp/timestomp-file.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Indicator Removal::Timestomp [T1070.006]
     examples:

anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:

anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml

@@ -7,7 +7,7 @@ rule:
       - "[email protected]"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion [T1497]
     mbc:

anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: basic block
-      dynamic: thread
+      dynamic: call
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:

anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:

anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:

anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:

anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml

@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:

anti-analysis/anti-vm/vm-detection/detect-vm-via-motherboard-hardware-wmi-queries.yml

@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:

collection/acquire-credentials-from-windows-credential-manager.yml

@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores::Windows Credential Manager [T1555.004]
     examples:

collection/browser/gather-firefox-profile-information.yml

@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores::Credentials from Web Browsers [T1555.003]
     examples:

collection/database/sql/reference-sql-statements.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: call
     att&ck:
       - Collection::Data from Information Repositories [T1213]
     examples:

collection/database/wmi/reference-wmi-statements.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: call
     att&ck:
       - Collection::Data from Information Repositories [T1213]
     examples:

collection/file-managers/gather-3d-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-alftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-bitkinex-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-blazeftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-bulletproof-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-classicftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: call
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-coreftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-cuteftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-cyberduck-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-direct-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-directory-opus-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-expandrive-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-faststone-browser-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-fasttrack-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ffftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-filezilla-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-flashfxp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-fling-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-freshftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     examples:

collection/file-managers/gather-frigate3-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ftp-commander-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ftp-explorer-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ftp-voyager-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ftpgetter-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ftpinfo-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ftpnow-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     examples:

collection/file-managers/gather-ftprush-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ftpshell-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-global-downloader-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-goftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-leapftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     examples:

collection/file-managers/gather-netdrive-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-nexusfile-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-nova-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     examples:

collection/file-managers/gather-robo-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-securefx-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-smart-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-softx-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-southriver-webdrive-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-staff-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-total-commander-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-turbo-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ultrafxp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     examples:

collection/file-managers/gather-winscp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-winzip-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-wise-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-ws-ftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/file-managers/gather-xftp-information.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Credential Access::Credentials from Password Stores [T1555]
     references:

collection/get-geographical-location.yml

@@ -8,7 +8,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: call
     att&ck:
       - Discovery::System Location Discovery [T1614]
     examples:

collection/group-policy/discover-group-policy-via-gpresult.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Discovery::Group Policy Discovery [T1615]
     examples:

collection/keylog/log-keystrokes.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Collection::Input Capture::Keylogging [T1056.001]
     examples:

collection/microphone/capture-microphone-audio.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Collection::Audio Capture [T1123]
     examples:

collection/network/capture-network-configuration-via-ipconfig.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: basic block
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Discovery::System Network Configuration Discovery [T1016]
     examples:

collection/network/capture-packets-using-sharppcap.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Discovery::Network Sniffing [T1040]
     references:

collection/network/capture-public-ip.yml

@@ -7,7 +7,7 @@ rule:
       - "[email protected]"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Discovery::System Network Configuration Discovery [T1016]
     examples:

collection/network/get-domain-trust-relationships.yml

@@ -6,7 +6,7 @@ rule:
       - johnk3r
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Discovery::Domain Trust Discovery [T1482]
     examples:

collection/network/get-mac-address-on-windows.yml

@@ -8,7 +8,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Discovery::System Information Discovery [T1082]
     references:

collection/screenshot/capture-screenshot-via-keybd-event.yml

@@ -6,7 +6,7 @@ rule:
       - "@_re_fox"
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Collection::Screen Capture [T1113]
     mbc:

collection/screenshot/capture-screenshot.yml

@@ -8,7 +8,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Collection::Screen Capture [T1113]
     mbc:

collection/webcam/capture-webcam-image.yml

@@ -6,7 +6,7 @@ rule:
       - johnk3r
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Collection::Video Capture [T1125]
     examples:

communication/c2/file-transfer/download-and-write-a-file.yml

@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Command and Control::Ingress Tool Transfer [T1105]
     mbc:

communication/c2/file-transfer/write-and-execute-a-file.yml

@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Execution::Install Additional Program [B0023]
     examples:

communication/c2/shell/create-reverse-shell-on-linux.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Execution::Command and Scripting Interpreter::Unix Shell [T1059.004]
     mbc:

communication/c2/shell/create-reverse-shell.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003]
     mbc:

communication/c2/shell/execute-shell-command-and-capture-output.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Execution::Command and Scripting Interpreter::Windows Command Shell [T1059.003]
     references:

communication/c2/shell/execute-shell-command-received-from-socket-on-linux.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     att&ck:
       - Execution::Command and Scripting Interpreter::Unix Shell [T1059.004]
     examples:

communication/ftp/send/send-file-using-ftp.yml

@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Communication::FTP Communication::Send File [C0004.001]
       - Communication::FTP Communication::WinINet [C0004.002]

communication/http/client/connect-to-http-server.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Communication::HTTP Communication::Connect to Server [C0002.009]
     examples:

communication/http/client/connect-to-url.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Communication::HTTP Communication::Open URL [C0002.004]
     examples:

communication/http/client/create-http-request.yml

@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Communication::HTTP Communication::Create Request [C0002.012]
     examples:

communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml

@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: span of calls
     mbc:
       - Communication::HTTP Communication::Get Response [C0002.017]
     examples: