WFP Filters Blocking EDR Communication - Registry

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects registry modifications where the Windows Filtering Platform (WFP) is used to block connections of security products such as EDRs, antivirus, and other security agents by altering firewall rules. This behavior could be indication of hacktools like EDRSilencer, which exploit WFP to disrupt EDR communications by creating filters for EDR services and processes.

2025-02-18 00:00:00

None

85319dbe-79aa-47c1-af9f-43c1b4ea1f8c

attack.defense-evasion attack.t1562

Nextron Sigma feed only (private)