Unexpected result for file scope rule with match features

[mr-tz]

Description

I'm not sure, but am expecting a different result on a file scope rule like this

rule:
  meta:
    name: test
    namespace: test
    scope: file
  features:
    - and:
      - match: create process
      - match: send data

result

capa tests/data/Practical\ Malware\ Analysis\ Lab\ 01-01.dll_ -t test
loading : 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 568/568 [00:00<00:00, 1003.65 rules/s]
matching: 100%|█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 5/5 [00:00<00:00, 308.97 functions/s, skipped 3 library functions (60%)]
+------------------------+------------------------------------------------------------------------------------+
| md5                    | 290934c61de9176ad682ffdd65f0a669                                                   |
| sha1                   | a4b35de71ca20fe776dc72d12fb2886736f43c22                                           |
| sha256                 | f50e42c8dfaab649bde0398867e930b86c2a599e8db83b8260393082268f2dba                   |
| path                   | tests\data\Practical Malware Analysis Lab 01-01.dll_                               |
+------------------------+------------------------------------------------------------------------------------+


+-----------------------------+-------------------------------------------------------------------------------+
| MBC Objective               | MBC Behavior                                                                  |
|-----------------------------+-------------------------------------------------------------------------------|
| COMMAND AND CONTROL         | C2 Communication::Send Data [B0030.001]                                       |
| COMMUNICATION               | Socket Communication::Send Data [C0001.007]                                   |
| PROCESS                     | Create Process [C0017]                                                        |
+-----------------------------+-------------------------------------------------------------------------------+

+------------------------------------------------------+------------------------------------------------------+
| CAPABILITY                                           | NAMESPACE                                            |
|------------------------------------------------------+------------------------------------------------------|
| send data                                            | communication                                        |
| create process                                       | host-interaction/process/create                      |
+------------------------------------------------------+------------------------------------------------------+

expected (?)

+------------------------------------------------------+------------------------------------------------------+
| CAPABILITY                                           | NAMESPACE                                            |
|------------------------------------------------------+------------------------------------------------------|
| test                                                 | test                                                 |
+------------------------------------------------------+------------------------------------------------------+

[mr-tz]

changing the and to or results in: 😕

+------------------------------------------------------+------------------------------------------------------+
| CAPABILITY                                           | NAMESPACE                                            |
|------------------------------------------------------+------------------------------------------------------|
| create process                                       | host-interaction/process/create                      |
| test                                                 | test                                                 |
+------------------------------------------------------+------------------------------------------------------+

[mr-tz]

with

  features:
    - and:
      - match: create process
      - match: send data
      - string: "this is not here"

+------------------------------------------------------+------------------------------------------------------+
| CAPABILITY                                           | NAMESPACE                                            |
|------------------------------------------------------+------------------------------------------------------|
| send data                                            | communication                                        |
| create process                                       | host-interaction/process/create                      |
+------------------------------------------------------+------------------------------------------------------+

[mr-tz]

there seems to be at least one issue with the -t option / sub-rule selection

[williballenthin]

matched rules are not being reported to the file scope matcher correctly:

should see "create process" in there

[williballenthin]

"create process" is a basic block scope rule:

i bet basic block scope rule matches aren't being passed up to file scope

[williballenthin]

yeah, only function-scope matches were passed to file-scope matching.

[williballenthin]