Windows Security: Detect NoFilter Tool Activity via RonPolicy Filtering Policy Indicators

Alerts on Windows Filtering Platform policy change events containing "RonPolicy" consistent with NoFilter abuse.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Stamatis Chatzimangou (st0pp3r) (SigmaHQ), DRL 1.1
Published: 2024-01-05
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1134Access Token Manipulation
- T1134.001Token Impersonation/Theft
Defense Evasion
- T1134Access Token Manipulation
- T1134.001Token Impersonation/Theft
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security events related to filtering platform policy changes where fields contain the indicator 'RonPolicy'. It is intended to catch activity consistent with the NoFilter tool, which targets Windows Filtering Platform behavior as part of a privilege escalation technique. The detection relies on Security log events 5447 and 5449 and string matching on FilterName and ProviderContextName.

Reporting behind it

Related detections9 linkedT1134.001 — drag to rearrange

Malicious Potato Family Privilege Escalation Tool Execution (via process_creation)

Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)

Malicious Named Pipe kesknq for Token Impersonation (via pipe_created)

Suspicious New Rights Granted to an Account for Privilege Escalation (via security)

SharpDPAPI Tool Execution via Command-Line and PE Metadata on Windows

SharpImpersonation Tool Execution on Windows

Windows Process Creation: Impersonate.exe HackTool Execution

Windows Security 4624 LogonType 9 Impersonation via Negotiate (Advapi) Token Abuse Indicator

Windows: Detect Named Pipe Creation with Koh Default Names

Windows Security: Detect NoFilter Tool Activity via RonPolicy Filtering Policy Indicators

Pivot detection · T1134.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-detect-nofilter-execution-via-ronpolicy-filtering-platform-indi-7b14c76a

title: "Windows Security: Detect NoFilter Tool Activity via RonPolicy Filtering Policy Indicators"
id: 60b1c2c3-11f0-4ab8-8a88-029b47c1cf6f
status: test
description: This rule flags Windows Security events related to filtering platform policy changes where fields contain the indicator 'RonPolicy'. It is intended to catch activity consistent with the NoFilter tool, which targets Windows Filtering Platform behavior as part of a privilege escalation technique. The detection relies on Security log events 5447 and 5449 and string matching on FilterName and ProviderContextName.
references:
  - https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp
  - https://github.com/deepinstinct/NoFilter
  - https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation
  - https://x.com/_st0pp3r_/status/1742203752361128162?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hktl_nofilter.yml
author: Stamatis Chatzimangou (st0pp3r), Huntrule Team
date: 2024-01-05
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134
  - attack.t1134.001
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Filtering Platform Policy Change needs to be enabled"
detection:
  selection_5447:
    EventID: 5447
    FilterName|contains: RonPolicy
  selection_5449:
    EventID: 5449
    ProviderContextName|contains: RonPolicy
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7b14c76a-c602-4ae6-9717-eff868153fc0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL