Rule Info
Name
WFP Filter Added via Registry
Author
Frack113
Description
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.
Date
2025-10-23 00:00:00
Modified
None
Id
1f1d8209-636e-4c6c-a137-781cca8b82f9
Tags
attack.execution attack.defense-impairment attack.t1685 attack.t1569.002
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR