improve TCP/UDP socket creation matching #964

[dhruvak001]

Fixes #964

I have also added number: 17 = IPPROTO_UDP , can make the rule more precise by explicitly matching cases where the UDP protocol is specified. (but not needed specifically)

[x] No CHANGELOG update needed
[x] No new tests needed
[x] No documentation update needed

[dhruvak001]

@williballenthin can you please review it, the example given initially in the code is said to be not existing.

[mike-hunhoff]

@dhruvak001 your updates to the rule create udp socket are causing the rule to no longer match for the test sample 203BD48BCC18434314AD60F4C8BC21E3D3422EB0624B22B827410F9BC63B4082:0x401240. You'll need to review the referenced function 0x401240 in a disassembly tool (Ghidra/IDA/etc.) to determine why the changes are not matching as expected. The referenced sample 203BD48BCC18434314AD60F4C8BC21E3D3422EB0624B22B827410F9BC63B4082 can be found at https://github.com/mandiant/capa-testfiles.

You can also use https://github.com/mandiant/capa/blob/master/scripts/show-features.py to view the features that capa extracts for the referenced function to debug the problem.