Add patch-antimalware-scan-interface-function.yml and updated patch-e…

[jtothej]

Add patch-antimalware-scan-interface-function.yml and updated patch-event-tracing-for-windows-function.yml

[williballenthin]

i think we should factor this logic out into a library rule, like patch read-only memory at runtime or something

[williballenthin]

then we can have a rule like hook function at runtime and then the rules in this PR boil down to:

    - match: hook function at runtime
    - or:
      - string: AmsiScanBuffer
      - string: AmsiScanString

and

    - match: hook function at runtime
    - or:
      - string: EventWrite
      - ...

[jtothej]

I was initially thinking about using allocate RWX memory (which in turn depends on allocate memory) but allocate memory matches on both memory allocation functions and functions that change of protection of already allocated memory.
So maybe we could split allocate memory to actual allocate memory and something like change memory protection (including VirtualProtect, VirtualProtectEx, NtProtectVirtualMemory, ZwProtectVirtualMemory). The we could have change memory protection to RWX and use it in rules in this PR. The problem with this approach would be figuring out which rules currently using allocate memory rule depend on memory allocation functions, which depend on change of memory functions and which on both.

[williballenthin]

yup, that sounds like a great refactor!

[mr-tz]

refactoring this in #836

[mr-tz]

update once #836 was merged