EDRSilencer Execution - WFP Filter Added/Changed

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•38

Detects the execution of EDRSilencer, a tool that manipulates the Windows Filtering Platform (WFP) to block outbound network traffic from EDR agents. This is identified by monitoring Windows Security Event IDs 5441 (A Windows Filtering Platform filter has been added) or 5447 (A Windows Filtering Platform filter has been changed) in conjunction with the specific filter name 'Custom Outbound Filter' used by EDRSilencer.