Update enumerate-network-filters-via-wfp-api.yml

mandiant · Sep 14, 2024 · afafcca · afafcca
1 parent a516554
commit afafcca
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/host-interaction/network/traffic/filter/enumerate-network-filters-via-wfp-api.yml b/host-interaction/network/traffic/filter/enumerate-network-filters-via-wfp-api.yml
@@ -6,10 +6,7 @@ rule:
       - jakub.jozwiak@mandiant.com
     scopes:
       static: function
-      dynamic: call
-    att&ck:
-      - Impact::Data Manipulation::Transmitted Data Manipulation [T1565.002]
-      - Defense Evasion::Impair Defenses::Disable or Modify System Firewall [T1562.004]
+      dynamic: thread
     references:
       - https://learn.microsoft.com/en-us/windows/win32/api/fwpmu/nf-fwpmu-fwpmfilterenum0
       - https://github.com/netero1010/EDRSilencer/blob/main/EDRSilencer.c