improve TCP/UDP socket creation matching #964 (#993)

* improve TCP/UDP socket creation matching #964

* Adding references

* adding IPPROTO_UDP

* relax rule

* function -> basic block

* adding bytes for indirect(0)

* adding bytes for indirect(0)

* back to default changes

* moved to nursery

* final change

* resolving comment

* indentation error

Author: dhruvak001

communication/socket/tcp/create-tcp-socket.yml

@@ -12,12 +12,17 @@ rule:
       dynamic: call
     mbc:
       - Communication::Socket Communication::Create TCP Socket [C0001.011]
+    references:
+      - https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-socket
+      - https://man7.org/linux/man-pages/man2/socket.2.html
     examples:
       - Practical Malware Analysis Lab 01-01.dll_:0x10001010
   features:
     - or:
       - and:
-        - number: 6 = IPPROTO_TCP
+        - or:
+          - number: 0 = protocol (default)
+          - number: 6 = IPPROTO_TCP
         - number: 1 = SOCK_STREAM
         - number: 2 = AF_INET
         - or:

communication/socket/udp/send/create-udp-socket.yml renamed to nursery/create-udp-socket.yml

@@ -11,12 +11,17 @@ rule:
       dynamic: call
     mbc:
       - Communication::Socket Communication::Create UDP Socket [C0001.010]
-    examples:
-      - 203BD48BCC18434314AD60F4C8BC21E3D3422EB0624B22B827410F9BC63B4082:0x401240
+    references:
+      - https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-socket
+      - https://man7.org/linux/man-pages/man2/socket.2.html
   features:
     - or:
       - and:
-        - count(number(2 = AF_INET/SOCK_DGRAM)): 2 or more
+        - number: 2 = AF_INET
+        - number: 2 = SOCK_DGRAM
+        - or:
+          - number: 0 = protocol (default)
+          - number: 17 = IPPROTO_UDP
         - or:
           - api: socket
           - api: ws2_32.socket