Merge pull request #932 from jtothej/netfw1

Add access-firewall-policy-via-inetfwpolicy2.yml and access-firewall-…

host-interaction/firewall/modify/access-firewall-policy-via-inetfwpolicy2.yml

@@ -0,0 +1,20 @@
+rule:
+ meta:
+ name: access firewall policy via INetFwPolicy2
+ namespace: host-interaction/firewall/modify
+ authors:
+ - jakub.jozwiak@mandiant.com
+ scopes:
+ static: function
+ dynamic: thread
+ att&ck:
+ - Discovery::Software Discovery::Security Software Discovery [T1518.001]
+ references:
+ - https://learn.microsoft.com/en-us/windows/win32/api/netfw/nn-netfw-inetfwpolicy2
+ examples:
+ - a210a5daaf487fe6c8bbaf906abce749042f15890d60b09c6cb333e54958663b:0x180002D60
+ features:
+ - and:
+ - api: ole32.CoCreateInstance
+ - bytes: 7f c9 b3 e2 e1 6a ac 41 81 7a f6 f9 21 66 d7 dd = CLSID_FwPolicy2
+ - bytes: 47 50 32 98 71 c6 74 41 8d 81 de fc d3 f0 31 86 = IID_INetFwPolicy2

host-interaction/firewall/modify/access-firewall-rule-properties-via-inetfwrule.yml

@@ -0,0 +1,20 @@
+rule:
+ meta:
+ name: access firewall rule properties via INetFwRule
+ namespace: host-interaction/firewall/modify
+ authors:
+ - jakub.jozwiak@mandiant.com
+ scopes:
+ static: function
+ dynamic: thread
+ att&ck:
+ - Discovery::Software Discovery::Security Software Discovery [T1518.001]
+ references:
+ - https://learn.microsoft.com/en-us/windows/win32/api/netfw/nn-netfw-inetfwrule
+ examples:
+ - a210a5daaf487fe6c8bbaf906abce749042f15890d60b09c6cb333e54958663b:0x180002D60
+ features:
+ - and:
+ - api: ole32.CoCreateInstance
+ - bytes: 3e c4 5b 2c 69 33 33 4c ab 0c be 94 69 67 7a f4 = CLSID_FwRule
+ - bytes: 27 0d 23 af ba ba 42 4e ac ed f5 24 f2 2c fc e2 = IID_INetFwRule