Windows Filtering Platform Blocked Connection From EDR Agent Binary
This rule detects when the Windows Filtering Platform (WFP) blocks a network connection initiated by a known Endpoint Detection and Response (EDR) agent binary. Adversaries may manipulate WFP filters to prevent EDR agents from communicating with their command and control servers or reporting security events, thereby impairing defensive capabilities. The rule specifically looks for Event ID 5157 (A Windows Filtering Platform callout blocked a connection) and checks if the `Application` field ends with the executable names of various common EDR products.
Sigma
