HackTool - EDRSilencer Execution - Filter Added

Rule Info

Name
HackTool - EDRSilencer Execution - Filter Added
Author
Thodoris Polyzos (@SmoothDeploy)
Description
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.
Reference
https://github.com/netero1010/EDRSilencer
Date
2024-01-29 00:00:00
Modified
2024-01-30 00:00:00
Id
98054878-5eab-434c-85d4-72d4e5a3361b
Tags
attack.defense_evasion attack.t1562 DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=98054878-5eab-434c-85d4-72d4e5a3361b

Rule History

Author
Title
Date
Commit
frack113
Merge PR #4697 from @frack113 - Fix errors in rule status and logsource
2024-01-31
ebaa1ab3f
t-pol
Merge PR #4685 from @t-pol - Add EDR-Silencer rule based on filter name indicator
2024-01-29
d7206ad1d
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022