Windows Security: EDRSilencer Execution via Filtering Platform Filter Added

title: "Windows Security: EDRSilencer Execution via Filtering Platform Filter Added"
id: bb0454db-75b6-4aba-80da-801996bfd4ee
status: test
description: This rule flags Windows Security events indicating a Filtering Platform policy change that adds a custom outbound filter named like "Custom Outbound Filter." It is intended to catch execution of EDRSilencer, a tool that abuses Windows Filtering Platform to block outbound traffic for running endpoint security agents. The detection relies on Windows Security audit events (EventID 5441 and 5447) and matches the filter name contained within those events. Filter-related telemetry is required (Audit Filtering Platform Policy Change).
references:
  - https://github.com/netero1010/EDRSilencer
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hktl_edr_silencer.yml
author: Thodoris Polyzos (@SmoothDeploy), Huntrule Team
date: 2024-01-29
modified: 2024-01-30
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Filtering Platform Policy Change needs to be enabled"
detection:
  selection:
    EventID:
      - 5441
      - 5447
    FilterName|contains: Custom Outbound Filter
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 98054878-5eab-434c-85d4-72d4e5a3361b
    type: derived