Windows Filtering Platform Policy Added to Block EDR Process

name: Windows Filtering Platform Policy Added to Block EDR Process
id: 1dea4856-f096-4e9d-9bd3-22c568dac5fe
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects the modification of a Windows Filtering Platform Policy to block the communication of known EDR processes.
    This can be used by attackers to impair the functionality of these tools and to hide their activities on the machine.
data_source:
    - Sysmon EventID 13
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Registry where

    Registry.action="modified"
    Registry.registry_path="*\\Parameters\\FirewallPolicy\\FirewallRules*"
    Registry.registry_value_data="*Action=Block*"
    Registry.registry_value_data="*App=*"
    Registry.registry_value_data IN (
        "*AmSvc.exe*",
        "*cb.exe*",
        "*CETASvc.exe*",
        "*CNTAoSMgr.exe*",
        "*CrAmTray.exe*",
        "*CrsSvc.exe*",
        "*CybereasonAV.exe*",
        "*CylanceSvc.exe*",
        "*cyserver.exe*",
        "*CyveraService.exe*",
        "*CyvrFsFlt.exe*",
        "*EIConnector.exe*",
        "*ekrn.exe*",
        "*elastic-agent.exe*",
        "*elastic-endpoint.exe*",
        "*EndpointBasecamp.exe*",
        "*ExecutionPreventionSvc.exe*",
        "*filebeat.exe*",
        "*fortiedr.exe*",
        "*hurukai.exe*",
        "*LogProcessorService.exe*",
        "*MsMpEng.exe*",
        "*MsSense.exe*",
        "*Ntrtscan.exe*",
        "*PccNTMon.exe*",
        "*QualysAgent.exe*",
        "*RepMgr.exe*",
        "*RepUtils.exe*",
        "*RepUx.exe*",
        "*RepWAV.exe*",
        "*RepWSC.exe*",
        "*SenseCncProxy.exe*",
        "*SenseIR.exe*",
        "*SenseNdr.exe*",
        "*SenseSampleUploader.exe*",
        "*SentinelAgent.exe*",
        "*SentinelAgentWorker.exe*",
        "*SentinelBrowserNativeHost.exe*",
        "*SentinelHelperService.exe*",
        "*SentinelServiceHost.exe*",
        "*SentinelStaticEngine.exe*",
        "*SentinelStaticEngineScanner.exe*",
        "*sfc.exe*",
        "*TaniumClient.exe*",
        "*TaniumCX.exe*",
        "*TaniumDetectEngine.exe*",
        "*TMBMSRV.exe*",
        "*TmCCSF.exe*",
        "*TmListen.exe*",
        "*TmWSCSvc.exe*",
        "*Traps.exe*",
        "*winlogbeat.exe*",
        "*WSCommunicator.exe*",
        "*xagt.exe*"
    )

    by Registry.dest Registry.vendor_product Registry.user Registry.status
       Registry.registry_value_name Registry.registry_path Registry.registry_hive
       Registry.registry_value_data Registry.action Registry.process_path
       Registry.process_guid Registry.process_id Registry.registry_key_name

    | `drop_dm_object_name(Registry)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_filtering_platform_policy_added_to_block_edr_process_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate administrative tasks or security configurations may create filtering platform policies. Verify actions with authorized IT personnel before alerting.
references:
    - https://unit42.paloaltonetworks.com/edr-bypass-extortion-attempt-thwarted/
    - https://github.com/wavestone-cdt/EDRSandblast?tab=readme-ov-file
drilldown_searches:
    - earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
      name: View the detection results for - "$user$" and "$dest$"
      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: Suspicious Windows Filtering Platform Policy with value $registry_value_data$ created on $dest$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: registry_path
      type: registry_path
    - field: registry_value_name
      type: registry_value_name
analytic_story:
    - Disabling Security Tools
    - Security Solution Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562/snapattack/snapattack.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit