Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add delete-network-filter-via-wfp-api.yml and enumerate-network-filters-via-wfp-api.yml #930

Merged
merged 2 commits into from
Sep 16, 2024
Merged

Add delete-network-filter-via-wfp-api.yml and enumerate-network-filters-via-wfp-api.yml #930

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a516554
Add host-interaction/network/traffic/filter/delete-network-filter-via…
jtothej Sep 14, 2024
afafcca
Update enumerate-network-filters-via-wfp-api.yml
jtothej Sep 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions host-interaction/network/traffic/filter/delete-network-filter-via-wfp-api.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
rule:
meta:
name: delete network filter via WFP API
namespace: host-interaction/network/traffic/filter
authors:
- jakub.jozwiak@mandiant.com
scopes:
static: function
dynamic: call
att&ck:
- Impact::Data Manipulation::Transmitted Data Manipulation [T1565.002]
- Defense Evasion::Impair Defenses::Disable or Modify System Firewall [T1562.004]
references:
- https://learn.microsoft.com/en-us/windows/win32/api/fwpmu/nf-fwpmu-fwpmfilterdeletebyid0
- https://learn.microsoft.com/en-us/windows/win32/api/fwpmu/nf-fwpmu-fwpmfilterdeletebykey0
- https://github.com/netero1010/EDRSilencer/blob/main/EDRSilencer.c
examples:
- d9531e53036c5d04fbe7d1aeae2988c3bf0fdec63774690c5df70cc121af8de4:0x10001DF0
features:
- or:
- api: fwpkclnt.FwpmFilterDeleteById0
- api: fwpkclnt.FwpmFilterDeleteByKey0
21 changes: 21 additions & 0 deletions host-interaction/network/traffic/filter/enumerate-network-filters-via-wfp-api.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
rule:
meta:
name: enumerate network filters via WFP API
namespace: host-interaction/network/traffic/filter
authors:
- jakub.jozwiak@mandiant.com
scopes:
static: function
dynamic: call
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
dynamic: call
dynamic: thread

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Updated in afafcca

att&ck:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe remove these?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Updated in afafcca

- Impact::Data Manipulation::Transmitted Data Manipulation [T1565.002]
- Defense Evasion::Impair Defenses::Disable or Modify System Firewall [T1562.004]
references:
- https://learn.microsoft.com/en-us/windows/win32/api/fwpmu/nf-fwpmu-fwpmfilterenum0
- https://github.com/netero1010/EDRSilencer/blob/main/EDRSilencer.c
examples:
- d9531e53036c5d04fbe7d1aeae2988c3bf0fdec63774690c5df70cc121af8de4:0x10001DF0
features:
- and:
- api: fwpkclnt.FwpmFilterCreateEnumHandle0
- api: fwpkclnt.FwpmFilterEnum0
Loading