rule:
  meta:
    name: send data on socket
    namespace: communication/socket/send
    authors:
      - moritz.raabe@mandiant.com
      - joakim@intezer.com
      - anushka.virgaonkar@mandiant.com
    scopes:
      static: function
      dynamic: process
    mbc:
      - Communication::Socket Communication::Send Data [C0001.007]
    examples:
      - Practical Malware Analysis Lab 01-01.dll_:0x10001010
  features:
    - or:
      - api: ws2_32.send
      - api: ws2_32.sendto
      - api: ws2_32.WSASend
      - api: ws2_32.WSASendMsg
      - api: ws2_32.WSASendTo
      - api: send
      - api: System.Net.Sockets.Socket::Send
      - api: System.Net.Sockets.Socket::SendAsync
      - api: System.Net.Sockets.Socket::SendTo
      - api: System.Net.Sockets.Socket::SendToAsync
      - api: System.Net.Sockets.UdpClient::Send