Windows WFP Blocked Connection Involving EDR Agent Binaries

title: Windows WFP Blocked Connection Involving EDR Agent Binaries
id: 8271e2e7-e6ff-42ab-825c-2930ddb57b64
status: test
description: This rule identifies Windows Filtering Platform (WFP) blocked connection events (EventID 5157) where the affected application is one of several common EDR or security agent executables. Attackers can attempt defense impairment by using WFP filtering to prevent EDR agents from communicating, thereby reducing visibility. It relies on Windows Security audit telemetry that records WFP blocked connection activity and includes the blocked application path/name.
references:
  - https://github.com/netero1010/EDRSilencer
  - https://github.com/amjcyber/EDRNoiseMaker
  - https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml
author: "@gott_cyber, Huntrule Team"
date: 2024-01-08
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Filtering Platform Connection needs to be enabled"
detection:
  selection:
    EventID: 5157
    Application|endswith:
      - \AmSvc.exe
      - \cb.exe
      - \CETASvc.exe
      - \CNTAoSMgr.exe
      - \CrAmTray.exe
      - \CrsSvc.exe
      - \CSFalconContainer.exe
      - \CSFalconService.exe
      - \CybereasonAV.exe
      - \CylanceSvc.exe
      - \cyserver.exe
      - \CyveraService.exe
      - \CyvrFsFlt.exe
      - \EIConnector.exe
      - \elastic-agent.exe
      - \elastic-endpoint.exe
      - \EndpointBasecamp.exe
      - \ExecutionPreventionSvc.exe
      - \filebeat.exe
      - \fortiedr.exe
      - \hmpalert.exe
      - \hurukai.exe
      - \LogProcessorService.exe
      - \mcsagent.exe
      - \mcsclient.exe
      - \MsMpEng.exe
      - \MsSense.exe
      - \Ntrtscan.exe
      - \PccNTMon.exe
      - \QualysAgent.exe
      - \RepMgr.exe
      - \RepUtils.exe
      - \RepUx.exe
      - \RepWAV.exe
      - \RepWSC.exe
      - \sedservice.exe
      - \SenseCncProxy.exe
      - \SenseIR.exe
      - \SenseNdr.exe
      - \SenseSampleUploader.exe
      - \SentinelAgent.exe
      - \SentinelAgentWorker.exe
      - \SentinelBrowserNativeHost.exe
      - \SentinelHelperService.exe
      - \SentinelServiceHost.exe
      - \SentinelStaticEngine.exe
      - \SentinelStaticEngineScanner.exe
      - \sfc.exe
      - \sophos ui.exe
      - \sophosfilescanner.exe
      - \sophosfs.exe
      - \sophoshealth.exe
      - \sophosips.exe
      - \sophosLivequeryservice.exe
      - \sophosnetfilter.exe
      - \sophosntpservice.exe
      - \sophososquery.exe
      - \sspservice.exe
      - \TaniumClient.exe
      - \TaniumCX.exe
      - \TaniumDetectEngine.exe
      - \TMBMSRV.exe
      - \TmCCSF.exe
      - \TmListen.exe
      - \TmWSCSvc.exe
      - \Traps.exe
      - \winlogbeat.exe
      - \WSCommunicator.exe
      - \xagt.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: bacf58c6-e199-4040-a94f-95dea0f1e45a
    type: derived