diff --git a/anti-analysis/anti-forensic/timestomp/timestomp-file.yml b/anti-analysis/anti-forensic/timestomp/timestomp-file.yml
index 02c922ad..f2477b15 100644
--- a/anti-analysis/anti-forensic/timestomp/timestomp-file.yml
+++ b/anti-analysis/anti-forensic/timestomp/timestomp-file.yml
@@ -9,8 +9,8 @@ rule:
     examples:
       - Practical Malware Analysis Lab 03-04.exe_:0x4014e0
   features:
-    - or:
-      - and:
+    - and:
+      - or:
         - api: kernel32.GetSystemTime
         - api: kernel32.FileTimeToLocalFileTime
         - api: kernel32.GetSystemTimeAsFileTime
diff --git a/anti-analysis/anti-vm/vm-detection/execute-anti-vm-instructions.yml b/anti-analysis/anti-vm/vm-detection/execute-anti-vm-instructions.yml
index d7e51a7e..6310a44b 100644
--- a/anti-analysis/anti-vm/vm-detection/execute-anti-vm-instructions.yml
+++ b/anti-analysis/anti-vm/vm-detection/execute-anti-vm-instructions.yml
@@ -3,7 +3,7 @@ rule:
     name: execute anti-VM instructions
     namespace: anti-analysis/anti-vm/vm-detection
     author: moritz.raabe@fireeye.com
-    scope: function
+    scope: basic block
     att&ck:
       - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
     mbc:
diff --git a/communication/socket/tcp/create-tcp-socket.yml b/communication/socket/tcp/create-tcp-socket.yml
index 7c62bf0c..e5fbd417 100644
--- a/communication/socket/tcp/create-tcp-socket.yml
+++ b/communication/socket/tcp/create-tcp-socket.yml
@@ -3,7 +3,7 @@ rule:
     name: create TCP socket
     namespace: communication/socket/tcp
     author: william.ballenthin@fireeye.com
-    scope: function
+    scope: basic block
     examples:
       - Practical Malware Analysis Lab 01-01.dll_:0x10001010
   features:
diff --git a/communication/socket/udp/send/create-udp-socket.yml b/communication/socket/udp/send/create-udp-socket.yml
index f13a9134..486324fa 100644
--- a/communication/socket/udp/send/create-udp-socket.yml
+++ b/communication/socket/udp/send/create-udp-socket.yml
@@ -3,7 +3,7 @@ rule:
     name: create UDP socket
     namespace: communication/socket/udp/send
     author: moritz.raabe@fireeye.com
-    scope: function
+    scope: basic block
     examples:
       - 203BD48BCC18434314AD60F4C8BC21E3D3422EB0624B22B827410F9BC63B4082:0x401240
   features: