rule:
  meta:
    name: reference SQL statements
    namespace: collection/database/sql
    authors:
      - william.ballenthin@mandiant.com
    scopes:
      static: function
      dynamic: process
    att&ck:
      - Collection::Data from Information Repositories [T1213]
    examples:
      - 5F66B82558CA92E54E77F216EF4C066C:0x42B1DF
  features:
    - and:
      - string: /SELECT.*FROM.*WHERE/