win_security_hktl_nofilter

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•23

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators