HackTool - EDRSilencer Execution - Filter Added
Thodoris Polyzos (@SmoothDeploy)
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.
attack.defense_evasion attack.t1562 DEMO
Link to Public Repo