Detection: Windows EDRSilencer Custom Outbound Filter Added

Description

The following analytic detects the EDRSilencer-specific Windows Filtering Platform filter name "Custom Outbound Filter" when it is configured with a block action. EDRSilencer creates WFP filters to block outbound traffic from EDR and security agent processes, impairing endpoint telemetry without requiring the tool binary to keep its original process name. EventCode 5447 identifies creation of the runtime filter with ChangeType %%16384, while EventCode 5441 can show the same persistent filter when the Base Filtering Engine starts.

Search

 1`wineventlog_security`
 2(
 3    (
 4        (
 5            EventCode=5447
 6            ChangeType IN ("%%16384", "Add")
 7        )
 8        OR
 9        EventCode=5441
10    )
11    Action IN ("%%16389", "Block")
12    FilterName="Custom Outbound Filter"
13)
14
15
16| eval user=coalesce(UserName,user,"unknown")
17
18| eval filter_action=case(Action="%%16389","Block", true(), Action),
19       change_type=case(ChangeType="%%16384","Add", true(), ChangeType)
20
21
22| stats count min(_time) as firstTime
23              max(_time) as lastTime
24              values(filter_action) as filter_action
25              values(change_type) as change_type
26              values(ProviderName) as provider_name
27              values(FilterType) as filter_type
28              values(FilterId) as filter_id
29              values(FilterKey) as filter_key
30              values(LayerName) as layer_name
31              values(LayerId) as layer_id
32              values(Conditions) as conditions
33              values(CalloutName) as callout_name
34  BY dest user process_id FilterName
35
36| `security_content_ctime(firstTime)`
37
38| `security_content_ctime(lastTime)`
39
40| `windows_edrsilencer_custom_outbound_filter_added_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Security 5447	Windows	'XmlWinEventLog'	'XmlWinEventLog:Security'
Windows Event Log Security 5441	Windows	'XmlWinEventLog'	'XmlWinEventLog:Security'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447 and EventCode 5441. The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events.

Known False Positives

This filter name is associated with EDRSilencer behavior. Validate whether any approved administrative tooling creates WFP block filters with the same name before tuning.

Associated Analytic Story

• Disabling Security Tools

• Security Solution Tampering

Finding

Threat Objects

References

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447

• https://github.com/netero1010/EDRSilencer

• https://learn.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging

• https://github.com/mthcht/awesome-lists/blob/main/Lists/Others/windows%20message%20tables/windows_messagetable_strings_list.csv

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1