huntrule

Windows: EDRSilencer HackTool Execution via EDRSilencer.exe Process Creation

Flags execution of EDRSilencer.exe on Windows based on process image and identifying metadata.

FreeUnreviewedSigmahighv1
title: "Windows: EDRSilencer HackTool Execution via EDRSilencer.exe Process Creation"
id: bcb592f0-9c87-413b-955a-83287e7e9818
status: test
description: This rule matches process creation events where the executed image is EDRSilencer.exe (or the process metadata identifies OriginalFileName/Description as EDRSilencer). EDRSilencer is used to impair endpoint detection by leveraging Windows Filtering Platform to interfere with EDR event reporting. Telemetry relies on Windows process creation fields such as Image path, OriginalFileName, and process Description to confirm the tool’s presence.
references:
  - https://github.com/netero1010/EDRSilencer
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_edrsilencer.yml
author: "@gott_cyber, Huntrule Team"
date: 2024-01-02
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \EDRSilencer.exe
    - OriginalFileName: EDRSilencer.exe
    - Description|contains: EDRSilencer
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: eb2d07d4-49cb-4523-801a-da002df36602
    type: derived

What it detects

This rule matches process creation events where the executed image is EDRSilencer.exe (or the process metadata identifies OriginalFileName/Description as EDRSilencer). EDRSilencer is used to impair endpoint detection by leveraging Windows Filtering Platform to interfere with EDR event reporting. Telemetry relies on Windows process creation fields such as Image path, OriginalFileName, and process Description to confirm the tool’s presence.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.