Update test_rules.py

tests/test_rules.py

@@ -387,10 +387,12 @@ def test_subscope_rules():
                                 dynamic: process
                         features:
                             - and:
-                                - string: yo
+                                - string: /etc/shadow
-                                - instruction:
+                                - or:
-                                    - mnemonic: shr
+                                    - api: open
-                                    - number: 5
+                                    - instruction:
+                                        - mnemonic: syscall
+                                        - number: 2 = open syscall number
                     """
                 )
             ),