Rule Info
Name
HackTool - EDRSilencer Execution - Filter Added
Author
Thodoris Polyzos (@SmoothDeploy)
Description
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.
Date
2024-01-29 00:00:00
Modified
2024-01-30 00:00:00
Id
98054878-5eab-434c-85d4-72d4e5a3361b
Tags
attack.defense-evasion attack.t1562 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
frack113
Merge PR #4697 from @frack113 - Fix errors in rule status and logsource
2024-01-31
t-pol
Merge PR #4685 from @t-pol - Add EDR-Silencer rule based on filter name indicator
2024-01-29
Scan your endpoints, forensic images or collected files with our portable scanner THOR