This rule will find files utilizing WinSock. A match for this rule would indicate that the sample is likely able to communicate over the network.

As stated in Microsoft’s documentation, The WSAStartup function is called to initiate use of WS2_32.dll.https://docs.microsoft.com/en-us/windows/win32/winsock/initializing-winsock

rule winsock
{
	meta:
		description = "Utilizes Winsock"
		reference = "https://docs.microsoft.com/en-us/windows/win32/winsock/initializing-winsock"

	strings:
		$ = "WSAStartup" ascii wide
		$ = "ws2_32.dll" ascii wide nocase

	condition:
		any of them
}

YARA Rules Index