HackTool - EDRSilencer Execution - Filter Added

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•2

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.