Name:Windows EDRSilencer Custom Outbound Filter Added id:67fea630-445d-4c70-a7d0-584fddb93b86 version:1 date:None author:Nasreddine Bencherchali, Splunk status:production type:TTP Description:The following analytic detects the EDRSilencer-specific Windows Filtering Platform filter name "Custom Outbound Filter" when it is configured with a block action.
EDRSilencer creates WFP filters to block outbound traffic from EDR and security agent processes, impairing endpoint telemetry without requiring the tool binary to keep its original process name.
EventCode 5447 identifies creation of the runtime filter with ChangeType %%16384, while EventCode 5441 can show the same persistent filter when the Base Filtering Engine starts. Data_source:
-Windows Event Log Security 5441
-Windows Event Log Security 5447
search:`wineventlog_security` ( ( ( EventCode=5447 ChangeType IN ("%%16384", "Add") ) OR EventCode=5441 ) Action IN ("%%16389", "Block") FilterName="Custom Outbound Filter" )
| stats count min(_time) as firstTime max(_time) as lastTime values(filter_action) as filter_action values(change_type) as change_type values(ProviderName) as provider_name values(FilterType) as filter_type values(FilterId) as filter_id values(FilterKey) as filter_key values(LayerName) as layer_name values(LayerId) as layer_id values(Conditions) as conditions values(CalloutName) as callout_name BY dest user process_id FilterName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_edrsilencer_custom_outbound_filter_added_filter`
how_to_implement:To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447 and EventCode 5441.
The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events. known_false_positives:This filter name is associated with EDRSilencer behavior.
Validate whether any approved administrative tooling creates WFP block filters with the same name before tuning. References: -https://github.com/netero1010/EDRSilencer -https://github.com/mthcht/awesome-lists/blob/main/Lists/Others/windows%20message%20tables/windows_messagetable_strings_list.csv -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447 -https://learn.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Disabling Security Tools', 'Security Solution Tampering']
