Merge pull request #33 from fireeye/update/bb-scopes

update to basic block scope

anti-analysis/anti-forensic/timestomp/timestomp-file.yml

@@ -9,8 +9,8 @@ rule:
     examples:
       - Practical Malware Analysis Lab 03-04.exe_:0x4014e0
   features:
-    - or:
-      - and:
+    - and:
+      - or:
         - api: kernel32.GetSystemTime
         - api: kernel32.FileTimeToLocalFileTime
         - api: kernel32.GetSystemTimeAsFileTime

anti-analysis/anti-vm/vm-detection/execute-anti-vm-instructions.yml

@@ -3,7 +3,7 @@ rule:
     name: execute anti-VM instructions
     namespace: anti-analysis/anti-vm/vm-detection
     author: moritz.raabe@fireeye.com
-    scope: function
+    scope: basic block
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:

communication/socket/tcp/create-tcp-socket.yml

@@ -3,7 +3,7 @@ rule:
     name: create TCP socket
     namespace: communication/socket/tcp
     author: william.ballenthin@fireeye.com
-    scope: function
+    scope: basic block
     examples:
       - Practical Malware Analysis Lab 01-01.dll_:0x10001010
   features:

communication/socket/udp/send/create-udp-socket.yml

@@ -3,7 +3,7 @@ rule:
     name: create UDP socket
     namespace: communication/socket/udp/send
     author: moritz.raabe@fireeye.com
-    scope: function
+    scope: basic block
     examples:
       - 203BD48BCC18434314AD60F4C8BC21E3D3422EB0624B22B827410F9BC63B4082:0x401240
   features: