Windows Security: Detect NoFilter execution via RonPolicy filtering platform indicators

title: "Windows Security: Detect NoFilter execution via RonPolicy filtering platform indicators"
id: 60b1c2c3-11f0-4ab8-8a88-029b47c1cf6f
status: test
description: This rule flags Windows Filtering Platform activity consistent with NoFilter usage by matching Security events tied to the hardcoded policy indicator "RonPolicy" in both event records and provider context. Attackers can leverage this technique to manipulate filtering policy behavior to support privilege escalation attempts. The detection relies on Windows Security telemetry for Event IDs 5447 and 5449 and string matches on FilterName and ProviderContextName.
references:
  - https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp
  - https://github.com/deepinstinct/NoFilter
  - https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation
  - https://x.com/_st0pp3r_/status/1742203752361128162?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hktl_nofilter.yml
author: Stamatis Chatzimangou (st0pp3r), Huntrule Team
date: 2024-01-05
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134
  - attack.t1134.001
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Filtering Platform Policy Change needs to be enabled"
detection:
  selection_5447:
    EventID: 5447
    FilterName|contains: RonPolicy
  selection_5449:
    EventID: 5449
    ProviderContextName|contains: RonPolicy
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7b14c76a-c602-4ae6-9717-eff868153fc0
    type: derived