change scope to call for atomic operations

mandiant · Oct 31, 2024 · 4449de5 · 4449de5
1 parent f880b13
commit 4449de5
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 18 deletions.
diff --git a/host-interaction/file-system/copy/copy-file.yml b/host-interaction/file-system/copy/copy-file.yml
@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: call
     mbc:
       - File System::Copy File [C0045]
     examples:
@@ -26,8 +26,7 @@ rule:
           - number: 2 = FO_COPY
           - or:
             - api: kernel32.SHFileOperation
-      - call:
-        - and:
-          - number: 2 = FO_COPY
-          - or:
-            - api: kernel32.SHFileOperation
+      - and:
+        - number: 2 = FO_COPY
+        - or:
+          - api: kernel32.SHFileOperation
diff --git a/host-interaction/file-system/move/move-file.yml b/host-interaction/file-system/move/move-file.yml
@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: call
     mbc:
       - File System::Move File [C0063]
     examples:
@@ -27,7 +27,6 @@ rule:
           - number: 1 = FO_MOVE
           - or:
             - api: kernel32.SHFileOperation
-      - call:
-        - and:
-          - number: 1 = FO_MOVE
-          - api: kernel32.SHFileOperation
+      - and:
+        - number: 1 = FO_MOVE
+        - api: kernel32.SHFileOperation
diff --git a/host-interaction/file-system/write/write-file-on-windows.yml b/host-interaction/file-system/write/write-file-on-windows.yml
@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: call
     mbc:
       - File System::Writes File [C0052]
     examples:
@@ -24,11 +24,10 @@ rule:
               - number: 0x40000000 = GENERIC_WRITE
               - number: 0x2 = FILE_WRITE_DATA
               - match: create or open file
-          - call:
-            - or:
-              - number: 0x40000000 = GENERIC_WRITE
-              - number: 0x2 = FILE_WRITE_DATA
-              - match: create or open file
+          - or:
+            - number: 0x40000000 = GENERIC_WRITE
+            - number: 0x2 = FILE_WRITE_DATA
+            - match: create or open file
         - or:
           - api: kernel32.WriteFile
           - api: kernel32.WriteFileEx

diff --git a/host-interaction/registry/create/set-registry-value.yml b/host-interaction/registry/create/set-registry-value.yml
@@ -7,7 +7,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: thread
+      dynamic: call
     mbc:
       - Operating System::Registry::Set Registry Key [C0036.001]
     examples: