Windows Filtering Platform Filter Added To Block EDR Process

Description

The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes. Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name. This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field.

Query · spl

`wineventlog_security`
EventCode=5447
ChangeType IN ("%%16384", "Add")
Action IN ("%%16389", "Block")
Conditions=*

| eval conditions_text=coalesce(Conditions,"")
| rex mode=sed field=conditions_text "s/-/ /g"
| rex mode=sed field=conditions_text "s/[0-9A-Fa-f]{8}\s+([0-9A-Fa-f]{2}\s+){1,16}//g"
| eval conditions_normalized=lower(replace(conditions_text, "[^A-Za-z0-9]", ""))
| eval edr_process=case(
        like(conditions_normalized, "%msmpengexe%"), "MsMpEng.exe",
        like(conditions_normalized, "%mssenseexe%"), "MsSense.exe",
        like(conditions_normalized, "%senseirexe%"), "SenseIR.exe",
        like(conditions_normalized, "%sensendrexe%"), "SenseNdr.exe",
        like(conditions_normalized, "%sensecncproxyexe%"), "SenseCncProxy.exe",
        like(conditions_normalized, "%sensesampleuploaderexe%"), "SenseSampleUploader.exe",
        like(conditions_normalized, "%winlogbeatexe%"), "winlogbeat.exe",
        like(conditions_normalized, "%elasticagentexe%"), "elastic-agent.exe",
        like(conditions_normalized, "%elasticendpointexe%"), "elastic-endpoint.exe",
        like(conditions_normalized, "%filebeatexe%"), "filebeat.exe",
        like(conditions_normalized, "%xagtexe%"), "xagt.exe",
        like(conditions_normalized, "%qualysagentexe%"), "QualysAgent.exe",
        like(conditions_normalized, "%sentinelagentexe%"), "SentinelAgent.exe",
        like(conditions_normalized, "%sentinelagentworkerexe%"), "SentinelAgentWorker.exe",
        like(conditions_normalized, "%sentinelservicehostexe%"), "SentinelServiceHost.exe",
        like(conditions_normalized, "%sentinelstaticengineexe%"), "SentinelStaticEngine.exe",
        like(conditions_normalized, "%logprocessorserviceexe%"), "LogProcessorService.exe",
        like(conditions_normalized, "%sentinelstaticenginescannerexe%"), "SentinelStaticEngineScanner.exe",
        like(conditions_normalized, "%sentinelhelperserviceexe%"), "SentinelHelperService.exe",
        like(conditions_normalized, "%sentinelbrowsernativehostexe%"), "SentinelBrowserNativeHost.exe",
        like(conditions_normalized, "%cylancesvcexe%"), "CylanceSvc.exe",
        like(conditions_normalized, "%amsvcexe%"), "AmSvc.exe",
        like(conditions_normalized, "%cramtrayexe%"), "CrAmTray.exe",
        like(conditions_normalized, "%crssvcexe%"), "CrsSvc.exe",
        like(conditions_normalized, "%executionpreventionsvcexe%"), "ExecutionPreventionSvc.exe",
        like(conditions_normalized, "%cybereasonavexe%"), "CybereasonAV.exe",
        like(conditions_normalized, "%cbexe%"), "cb.exe",
        like(conditions_normalized, "%repmgrexe%"), "RepMgr.exe",
        like(conditions_normalized, "%reputilsexe%"), "RepUtils.exe",
        like(conditions_normalized, "%repuxexe%"), "RepUx.exe",
        like(conditions_normalized, "%repwavexe%"), "RepWAV.exe",
        like(conditions_normalized, "%repwscexe%"), "RepWSC.exe",
        like(conditions_normalized, "%taniumclientexe%"), "TaniumClient.exe",
        like(conditions_normalized, "%taniumcxexe%"), "TaniumCX.exe",
        like(conditions_normalized, "%taniumdetectengineexe%"), "TaniumDetectEngine.exe",
        like(conditions_normalized, "%trapsexe%"), "Traps.exe",
        like(conditions_normalized, "%cyserverexe%"), "cyserver.exe",
        like(conditions_normalized, "%cyveraserviceexe%"), "CyveraService.exe",
        like(conditions_normalized, "%cyvrfsfltexe%"), "CyvrFsFlt.exe",
        like(conditions_normalized, "%fortiedrexe%"), "fortiedr.exe",
        like(conditions_normalized, "%sfcexe%"), "sfc.exe",
        like(conditions_normalized, "%eiconnectorexe%"), "EIConnector.exe",
        like(conditions_normalized, "%ekrnexe%"), "ekrn.exe",
        like(conditions_normalized, "%hurukaiexe%"), "hurukai.exe",
        like(conditions_normalized, "%cetasvcexe%"), "CETASvc.exe",
        like(conditions_normalized, "%wscommunicatorexe%"), "WSCommunicator.exe",
        like(conditions_normalized, "%endpointbasecampexe%"), "EndpointBasecamp.exe",
        like(conditions_normalized, "%tmlistenexe%"), "TmListen.exe",
        like(conditions_normalized, "%ntrtscanexe%"), "Ntrtscan.exe",
        like(conditions_normalized, "%tmwscsvcexe%"), "TmWSCSvc.exe",
        like(conditions_normalized, "%pccntmonexe%"), "PccNTMon.exe",
        like(conditions_normalized, "%tmbmsrvexe%"), "TMBMSRV.exe",
        like(conditions_normalized, "%cntaosmgrexe%"), "CNTAoSMgr.exe",
        like(conditions_normalized, "%tmccsfexe%"), "TmCCSF.exe"
    )
| where isnotnull(edr_process)
| eval user=coalesce(UserName,user,"unknown")

| eval filter_action=case(Action="%%16389","Block", true(), Action),
        change_type=case(ChangeType="%%16384","Add", true(), ChangeType)

| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(filter_action) as filter_action
              values(change_type) as change_type
              values(edr_process) as edr_process
              values(ProviderName) as provider_name
              values(FilterType) as filter_type
              values(FilterId) as filter_id
              values(LayerName) as layer_name
              values(LayerId) as layer_id
              values(Conditions) as conditions
              values(CalloutName) as callout_name

BY dest user process_id FilterName

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_filtering_platform_filter_added_to_block_edr_process_filter`

Implementation guide

To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447. The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events.

Known false positives

  • Legitimate firewall, VPN, EDR, and Group Policy changes can add WFP block filters. Tune by approved ProviderName, LayerName, FilterName, or known administrative windows after validating the WFP filter context.

Analyst notes

Known false positives: Legitimate firewall, VPN, EDR, and Group Policy changes can add WFP block filters. Tune by approved ProviderName, LayerName, FilterName, or known administrative windows after validating the WFP filter context.

Raw source Windows Filtering Platform Filter Added To Block EDR Process · SPL
Esc
Published by splunk/security_content ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
name: Windows Filtering Platform Filter Added To Block EDR Process
id: 8bb64b2a-299e-4ddc-a7e1-037bdc5b904a
version: 1
creation_date: '2026-08-23'
modification_date: '2026-08-23'
author: Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |-
    The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes.
    Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name.
    This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field.
data_source:
    - Windows Event Log Security 5447
search: |-
    `wineventlog_security`
    EventCode=5447
    ChangeType IN ("%%16384", "Add")
    Action IN ("%%16389", "Block")
    Conditions=*

    | eval conditions_text=coalesce(Conditions,"")
    | rex mode=sed field=conditions_text "s/-/ /g"
    | rex mode=sed field=conditions_text "s/[0-9A-Fa-f]{8}\s+([0-9A-Fa-f]{2}\s+){1,16}//g"
    | eval conditions_normalized=lower(replace(conditions_text, "[^A-Za-z0-9]", ""))
    | eval edr_process=case(
            like(conditions_normalized, "%msmpengexe%"), "MsMpEng.exe",
            like(conditions_normalized, "%mssenseexe%"), "MsSense.exe",
            like(conditions_normalized, "%senseirexe%"), "SenseIR.exe",
            like(conditions_normalized, "%sensendrexe%"), "SenseNdr.exe",
            like(conditions_normalized, "%sensecncproxyexe%"), "SenseCncProxy.exe",
            like(conditions_normalized, "%sensesampleuploaderexe%"), "SenseSampleUploader.exe",
            like(conditions_normalized, "%winlogbeatexe%"), "winlogbeat.exe",
            like(conditions_normalized, "%elasticagentexe%"), "elastic-agent.exe",
            like(conditions_normalized, "%elasticendpointexe%"), "elastic-endpoint.exe",
            like(conditions_normalized, "%filebeatexe%"), "filebeat.exe",
            like(conditions_normalized, "%xagtexe%"), "xagt.exe",
            like(conditions_normalized, "%qualysagentexe%"), "QualysAgent.exe",
            like(conditions_normalized, "%sentinelagentexe%"), "SentinelAgent.exe",
            like(conditions_normalized, "%sentinelagentworkerexe%"), "SentinelAgentWorker.exe",
            like(conditions_normalized, "%sentinelservicehostexe%"), "SentinelServiceHost.exe",
            like(conditions_normalized, "%sentinelstaticengineexe%"), "SentinelStaticEngine.exe",
            like(conditions_normalized, "%logprocessorserviceexe%"), "LogProcessorService.exe",
            like(conditions_normalized, "%sentinelstaticenginescannerexe%"), "SentinelStaticEngineScanner.exe",
            like(conditions_normalized, "%sentinelhelperserviceexe%"), "SentinelHelperService.exe",
            like(conditions_normalized, "%sentinelbrowsernativehostexe%"), "SentinelBrowserNativeHost.exe",
            like(conditions_normalized, "%cylancesvcexe%"), "CylanceSvc.exe",
            like(conditions_normalized, "%amsvcexe%"), "AmSvc.exe",
            like(conditions_normalized, "%cramtrayexe%"), "CrAmTray.exe",
            like(conditions_normalized, "%crssvcexe%"), "CrsSvc.exe",
            like(conditions_normalized, "%executionpreventionsvcexe%"), "ExecutionPreventionSvc.exe",
            like(conditions_normalized, "%cybereasonavexe%"), "CybereasonAV.exe",
            like(conditions_normalized, "%cbexe%"), "cb.exe",
            like(conditions_normalized, "%repmgrexe%"), "RepMgr.exe",
            like(conditions_normalized, "%reputilsexe%"), "RepUtils.exe",
            like(conditions_normalized, "%repuxexe%"), "RepUx.exe",
            like(conditions_normalized, "%repwavexe%"), "RepWAV.exe",
            like(conditions_normalized, "%repwscexe%"), "RepWSC.exe",
            like(conditions_normalized, "%taniumclientexe%"), "TaniumClient.exe",
            like(conditions_normalized, "%taniumcxexe%"), "TaniumCX.exe",
            like(conditions_normalized, "%taniumdetectengineexe%"), "TaniumDetectEngine.exe",
            like(conditions_normalized, "%trapsexe%"), "Traps.exe",
            like(conditions_normalized, "%cyserverexe%"), "cyserver.exe",
            like(conditions_normalized, "%cyveraserviceexe%"), "CyveraService.exe",
            like(conditions_normalized, "%cyvrfsfltexe%"), "CyvrFsFlt.exe",
            like(conditions_normalized, "%fortiedrexe%"), "fortiedr.exe",
            like(conditions_normalized, "%sfcexe%"), "sfc.exe",
            like(conditions_normalized, "%eiconnectorexe%"), "EIConnector.exe",
            like(conditions_normalized, "%ekrnexe%"), "ekrn.exe",
            like(conditions_normalized, "%hurukaiexe%"), "hurukai.exe",
            like(conditions_normalized, "%cetasvcexe%"), "CETASvc.exe",
            like(conditions_normalized, "%wscommunicatorexe%"), "WSCommunicator.exe",
            like(conditions_normalized, "%endpointbasecampexe%"), "EndpointBasecamp.exe",
            like(conditions_normalized, "%tmlistenexe%"), "TmListen.exe",
            like(conditions_normalized, "%ntrtscanexe%"), "Ntrtscan.exe",
            like(conditions_normalized, "%tmwscsvcexe%"), "TmWSCSvc.exe",
            like(conditions_normalized, "%pccntmonexe%"), "PccNTMon.exe",
            like(conditions_normalized, "%tmbmsrvexe%"), "TMBMSRV.exe",
            like(conditions_normalized, "%cntaosmgrexe%"), "CNTAoSMgr.exe",
            like(conditions_normalized, "%tmccsfexe%"), "TmCCSF.exe"
        )
    | where isnotnull(edr_process)
    | eval user=coalesce(UserName,user,"unknown")

    | eval filter_action=case(Action="%%16389","Block", true(), Action),
            change_type=case(ChangeType="%%16384","Add", true(), ChangeType)

    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(filter_action) as filter_action
                  values(change_type) as change_type
                  values(edr_process) as edr_process
                  values(ProviderName) as provider_name
                  values(FilterType) as filter_type
                  values(FilterId) as filter_id
                  values(LayerName) as layer_name
                  values(LayerId) as layer_id
                  values(Conditions) as conditions
                  values(CalloutName) as callout_name

    BY dest user process_id FilterName

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_filtering_platform_filter_added_to_block_edr_process_filter`
how_to_implement: |-
    To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447. The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events.
known_false_positives: |-
    Legitimate firewall, VPN, EDR, and Group Policy changes can add WFP block filters.
    Tune by approved ProviderName, LayerName, FilterName, or known administrative windows after validating the WFP filter context.
references:
    - https://github.com/netero1010/EDRSilencer
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447
    - https://learn.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: Windows Filtering Platform block filter targeting [$edr_process$] was detected on [$dest$].
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: edr_process
      type: process_name
    - field: FilterName
      type: signature
analytic_story:
    - Disabling Security Tools
    - Security Solution Tampering
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log
          source: XmlWinEventLog:Security
          sourcetype: XmlWinEventLog
      test_type: unit

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.