upgrade rules using updated script

[mr-tz]

837 and all the comments broke the GitHub web UI...

Repeating the work now here using a script and fixing things locally - for the most part.

[mr-tz]

See https://github.com/mandiant/capa-rules/pull/839/commits/409da0b775bd467d70826e5149974f3b2fffdbc3 for some first updates to rules with subscopes. Is that what you had in mind @williballenthin @yelhamer?

[mr-tz]

I think all rules have been upgraded now.

I did not use the process scope in any rule so far.

The linter needs to use the changes from the dynamic-feature-extraction branch to pass.

[mr-tz]

If you've looked at a dozen or so changes from each commit (as they roughly group changes) I'm fairly confident in these updates and don't think we need a detailed review of each rule.

[williballenthin]

ah, that's a great way to group changes. i'll do this review tomorrow. thanks!

[williballenthin]

• [x] ensure there are no more TODOs associated with scopes

[williballenthin]

@mr-tz please see dbefb55

[mr-tz]

Is VMCI_SOCKETS_GET_AF_VALUE a valid argument to socket?

The other changes look good, thank you!

[williballenthin]

via here: https://github.com/mandiant/capa/blob/210a13d94ea40114e01b40927c77c1c74047780f/capa/rules/__init__.py#L544

an instruction subscope acts implicitly like an and: so we can save a line/indentation by not adding those. same with call. maybe we can do a cleanup of all the rules in another PR.

[williballenthin]

Is VMCI_SOCKETS_GET_AF_VALUE a valid argument to socket?

ah, you're right, this is only passed to DeviceIoControl/ioctl. updated the logic to look like:

      - and:
        - os: windows
        - api: DeviceIoControl
        - number: 0x81032068 = VMCI_SOCKETS_GET_AF_VALUE
        - optional:
          - api: socket
      - and:
        - os: linux
        - api: ioctl
        - number: 0x7B8 = VMCI_SOCKETS_GET_AF_VALUE
        - optional:
          - api: socket

scope: basic block/call

[mr-tz]

For call scope the optional socket would never match and the scopes should still be thread (and function) IMO.

[mr-tz]

via here: https://github.com/mandiant/capa/blob/210a13d94ea40114e01b40927c77c1c74047780f/capa/rules/__init__.py#L544

an instruction subscope acts implicitly like an and: so we can save a line/indentation by not adding those. same with call. maybe we can do a cleanup of all the rules in another PR.

I don't see that implemented for call, but think we should add and simplify the rules.

[mr-tz]

rebased to master and:

• changed scopes again for VMCI socket: 5e2dae155ff67edc7489dc779c6f8159285aecb9
• updated scopes for new rules: 54308899027bf3c43e41067b0f986f1be55449ee
• graduated rule: 305adfd16bab08b2526596e56b50b638d8f4bf43