{"id":"98054878-5eab-434c-85d4-72d4e5a3361b","title":"HackTool - EDRSilencer Execution - Filter Added","description":"Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.\n","author":"Thodoris Polyzos (@SmoothDeploy)","status":"test","level":"high","date":"2024-01-29","modified":"2024-01-30","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Filtering Platform Policy Change needs to be enabled"},"falsepositives":["Unknown"],"references":["https://github.com/netero1010/EDRSilencer"],"source_path":"rules/windows/builtin/security/win_security_hktl_edr_silencer.yml","source_sha256":"074f2863af257d3a180dc49a7ba7297b5bcea686f4fb353b838fcb1187d86e7c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_hktl_edr_silencer.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - EDRSilencer Execution - Filter Added\nid: 98054878-5eab-434c-85d4-72d4e5a3361b\nstatus: test\ndescription: |\n    Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.\nreferences:\n    - https://github.com/netero1010/EDRSilencer\nauthor: Thodoris Polyzos (@SmoothDeploy)\ndate: 2024-01-29\nmodified: 2024-01-30\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: windows\n    service: security\n    definition: 'Requirements: Audit Filtering Platform Policy Change needs to be enabled'\ndetection:\n    selection:\n        EventID:\n            - 5441\n            - 5447\n        FilterName|contains: 'Custom Outbound Filter'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/98054878-5eab-434c-85d4-72d4e5a3361b.json","kind":"sigma"}