Windows Security: Detect NoFilter Tool Activity via RonPolicy Filtering Policy Indicators
Alerts on Windows Filtering Platform policy change events containing "RonPolicy" consistent with NoFilter abuse.
- Product
- windows
- Service
- security
- Author
- Stamatis Chatzimangou (st0pp3r) (SigmaHQ), DRL 1.1
- Published
- 2024-01-05
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security events related to filtering platform policy changes where fields contain the indicator 'RonPolicy'. It is intended to catch activity consistent with the NoFilter tool, which targets Windows Filtering Platform behavior as part of a privilege escalation technique. The detection relies on Security log events 5447 and 5449 and string matching on FilterName and ProviderContextName.
Reporting behind it
- github.comhttps://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp
- github.comhttps://github.com/deepinstinct/NoFilter
- deepinstinct.comhttps://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation
- x.comhttps://x.com/_st0pp3r_/status/1742203752361128162?s=20
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hktl_nofilter.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: Detect NoFilter Tool Activity via RonPolicy Filtering Policy Indicators"
id: 60b1c2c3-11f0-4ab8-8a88-029b47c1cf6f
status: test
description: This rule flags Windows Security events related to filtering platform policy changes where fields contain the indicator 'RonPolicy'. It is intended to catch activity consistent with the NoFilter tool, which targets Windows Filtering Platform behavior as part of a privilege escalation technique. The detection relies on Security log events 5447 and 5449 and string matching on FilterName and ProviderContextName.
references:
- https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp
- https://github.com/deepinstinct/NoFilter
- https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation
- https://x.com/_st0pp3r_/status/1742203752361128162?s=20
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hktl_nofilter.yml
author: Stamatis Chatzimangou (st0pp3r), Huntrule Team
date: 2024-01-05
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1134
- attack.t1134.001
logsource:
product: windows
service: security
definition: "Requirements: Audit Filtering Platform Policy Change needs to be enabled"
detection:
selection_5447:
EventID: 5447
FilterName|contains: RonPolicy
selection_5449:
EventID: 5449
ProviderContextName|contains: RonPolicy
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7b14c76a-c602-4ae6-9717-eff868153fc0
type: derived