Threat Hunt: EDR Silencer and Interpreter-Based Bypass
This specialized KQL query is designed to hunt for a particularly dangerous class of malicious activity: the deliberate disabling of Endpoint Detection and Response (EDR) security controls. It specifically targets the use of tools like EDR Silencer, which attackers deploy to "blind" security tools and operate stealthily on a compromised host. The logic focuses on high-confidence indicators, searching for the tool's executable itself or its distinctive command-line flags (blockedr, unblockall, etc.) when launched by common system interpreters like PowerShell or CMD. By filtering out noisy, legitimate activity related to document processing, this query provides security analysts with a prioritized list of potential EDR tampering incidents, enabling rapid investigation and response to this critical threat.
Microsoft Sentinel (KQL)
