huntrule

Windows Security: Detect NoFilter Tool Activity via RonPolicy Filtering Policy Indicators

Alerts on Windows Filtering Platform policy change events containing "RonPolicy" consistent with NoFilter abuse.

FreeReviewedSigma · High · v2
Product
windows
Service
security
Author
Stamatis Chatzimangou (st0pp3r) (SigmaHQ), DRL 1.1
Published
2024-01-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows Security events related to filtering platform policy changes where fields contain the indicator 'RonPolicy'. It is intended to catch activity consistent with the NoFilter tool, which targets Windows Filtering Platform behavior as part of a privilege escalation technique. The detection relies on Security log events 5447 and 5449 and string matching on FilterName and ProviderContextName.

Reporting behind it

Related detections9 linkedT1134.001 — drag to rearrange
Suspicious Command Shell Spawned by lmadmin License Manager via process_creation
Suspicious Potato Privilege Escalation Tool Execution via process_creation
Suspicious W32TIME Named Pipe Activity Linked to RPC Privilege Escalation (via pipe_created)
Suspicious runas NETONLY for Access Token Manipulation
Suspicious Access To Chrome Elevation Service COM Object via Katz Stealer
Malicious Potato Family Privilege Escalation Tool Execution (via process_creation)
Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)
Malicious Named Pipe kesknq for Token Impersonation (via pipe_created)
Suspicious New Rights Granted to an Account for Privilege Escalation (via security)
Windows Security: Detect NoFilter Tool Activity via RonPolicy Filtering Policy Indicators
Pivot detection · T1134.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.