Rule Info
Name
WFP Filter Added via Registry
Author
Frack113
Description
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.
Date
2025-10-23 00:00:00
Modified
None
Id
1f1d8209-636e-4c6c-a137-781cca8b82f9
Tags
attack.defense-evasion attack.execution attack.t1562 attack.t1569.002
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR