New T1562.004 Test "Open local port through Windows Firewall for any profile" (#1200)
* Update T1562.004.yaml added new atomic test to open a port through Windows Firewall to any profile * Update T1562.004.yaml added some fixes to command and cleanup Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
This commit is contained in:
@@ -61,3 +61,17 @@ atomic_tests:
|
||||
cleanup_command: netsh advfirewall firewall delete rule name="atomic testing" protocol=TCP localport=450 >nul 2>&1
|
||||
name: command_prompt
|
||||
elevation_required: true
|
||||
- name: Open a local port through Windows Firewall to any profile
|
||||
description: This test will attempt to open a local port defined by input arguments to any profile
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
local_port:
|
||||
description: This is the local port you wish to test opening
|
||||
type: integer
|
||||
default: 3389
|
||||
executor:
|
||||
command: netsh advfirewall firewall add rule name="Open Port to Any" dir=in protocol=tcp localport=#{local_port} action=allow profile=any
|
||||
cleanup_command: netsh advfirewall firewall delete rule name="Open Port to Any"
|
||||
name: powershell
|
||||
elevation_required: true
|
||||
|
||||
Reference in New Issue
Block a user