Detection: Windows Filtering Platform Filter Added To Block EDR Process

Updated Date: 2026-08-23 ID: 8bb64b2a-299e-4ddc-a7e1-037bdc5b904a Author: Nasreddine Bencherchali, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes. Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name. This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field.

Search

  1`wineventlog_security`
  2EventCode=5447
  3ChangeType IN ("%%16384", "Add")
  4Action IN ("%%16389", "Block")
  5Conditions=*
  6
  7
  8| eval conditions_text=coalesce(Conditions,"")
  9
 10| rex mode=sed field=conditions_text "s/-/ /g"
 11
 12| rex mode=sed field=conditions_text "s/[0-9A-Fa-f]{8}\s+([0-9A-Fa-f]{2}\s+){1,16}//g"
 13
 14| eval conditions_normalized=lower(replace(conditions_text, "[^A-Za-z0-9]", ""))
 15
 16| eval edr_process=case(
 17        like(conditions_normalized, "%msmpengexe%"), "MsMpEng.exe",
 18        like(conditions_normalized, "%mssenseexe%"), "MsSense.exe",
 19        like(conditions_normalized, "%senseirexe%"), "SenseIR.exe",
 20        like(conditions_normalized, "%sensendrexe%"), "SenseNdr.exe",
 21        like(conditions_normalized, "%sensecncproxyexe%"), "SenseCncProxy.exe",
 22        like(conditions_normalized, "%sensesampleuploaderexe%"), "SenseSampleUploader.exe",
 23        like(conditions_normalized, "%winlogbeatexe%"), "winlogbeat.exe",
 24        like(conditions_normalized, "%elasticagentexe%"), "elastic-agent.exe",
 25        like(conditions_normalized, "%elasticendpointexe%"), "elastic-endpoint.exe",
 26        like(conditions_normalized, "%filebeatexe%"), "filebeat.exe",
 27        like(conditions_normalized, "%xagtexe%"), "xagt.exe",
 28        like(conditions_normalized, "%qualysagentexe%"), "QualysAgent.exe",
 29        like(conditions_normalized, "%sentinelagentexe%"), "SentinelAgent.exe",
 30        like(conditions_normalized, "%sentinelagentworkerexe%"), "SentinelAgentWorker.exe",
 31        like(conditions_normalized, "%sentinelservicehostexe%"), "SentinelServiceHost.exe",
 32        like(conditions_normalized, "%sentinelstaticengineexe%"), "SentinelStaticEngine.exe",
 33        like(conditions_normalized, "%logprocessorserviceexe%"), "LogProcessorService.exe",
 34        like(conditions_normalized, "%sentinelstaticenginescannerexe%"), "SentinelStaticEngineScanner.exe",
 35        like(conditions_normalized, "%sentinelhelperserviceexe%"), "SentinelHelperService.exe",
 36        like(conditions_normalized, "%sentinelbrowsernativehostexe%"), "SentinelBrowserNativeHost.exe",
 37        like(conditions_normalized, "%cylancesvcexe%"), "CylanceSvc.exe",
 38        like(conditions_normalized, "%amsvcexe%"), "AmSvc.exe",
 39        like(conditions_normalized, "%cramtrayexe%"), "CrAmTray.exe",
 40        like(conditions_normalized, "%crssvcexe%"), "CrsSvc.exe",
 41        like(conditions_normalized, "%executionpreventionsvcexe%"), "ExecutionPreventionSvc.exe",
 42        like(conditions_normalized, "%cybereasonavexe%"), "CybereasonAV.exe",
 43        like(conditions_normalized, "%cbexe%"), "cb.exe",
 44        like(conditions_normalized, "%repmgrexe%"), "RepMgr.exe",
 45        like(conditions_normalized, "%reputilsexe%"), "RepUtils.exe",
 46        like(conditions_normalized, "%repuxexe%"), "RepUx.exe",
 47        like(conditions_normalized, "%repwavexe%"), "RepWAV.exe",
 48        like(conditions_normalized, "%repwscexe%"), "RepWSC.exe",
 49        like(conditions_normalized, "%taniumclientexe%"), "TaniumClient.exe",
 50        like(conditions_normalized, "%taniumcxexe%"), "TaniumCX.exe",
 51        like(conditions_normalized, "%taniumdetectengineexe%"), "TaniumDetectEngine.exe",
 52        like(conditions_normalized, "%trapsexe%"), "Traps.exe",
 53        like(conditions_normalized, "%cyserverexe%"), "cyserver.exe",
 54        like(conditions_normalized, "%cyveraserviceexe%"), "CyveraService.exe",
 55        like(conditions_normalized, "%cyvrfsfltexe%"), "CyvrFsFlt.exe",
 56        like(conditions_normalized, "%fortiedrexe%"), "fortiedr.exe",
 57        like(conditions_normalized, "%sfcexe%"), "sfc.exe",
 58        like(conditions_normalized, "%eiconnectorexe%"), "EIConnector.exe",
 59        like(conditions_normalized, "%ekrnexe%"), "ekrn.exe",
 60        like(conditions_normalized, "%hurukaiexe%"), "hurukai.exe",
 61        like(conditions_normalized, "%cetasvcexe%"), "CETASvc.exe",
 62        like(conditions_normalized, "%wscommunicatorexe%"), "WSCommunicator.exe",
 63        like(conditions_normalized, "%endpointbasecampexe%"), "EndpointBasecamp.exe",
 64        like(conditions_normalized, "%tmlistenexe%"), "TmListen.exe",
 65        like(conditions_normalized, "%ntrtscanexe%"), "Ntrtscan.exe",
 66        like(conditions_normalized, "%tmwscsvcexe%"), "TmWSCSvc.exe",
 67        like(conditions_normalized, "%pccntmonexe%"), "PccNTMon.exe",
 68        like(conditions_normalized, "%tmbmsrvexe%"), "TMBMSRV.exe",
 69        like(conditions_normalized, "%cntaosmgrexe%"), "CNTAoSMgr.exe",
 70        like(conditions_normalized, "%tmccsfexe%"), "TmCCSF.exe"
 71    )
 72
 73| where isnotnull(edr_process)
 74
 75| eval user=coalesce(UserName,user,"unknown")
 76
 77
 78| eval filter_action=case(Action="%%16389","Block", true(), Action),
 79        change_type=case(ChangeType="%%16384","Add", true(), ChangeType)
 80
 81
 82| stats count min(_time) as firstTime
 83              max(_time) as lastTime
 84              values(filter_action) as filter_action
 85              values(change_type) as change_type
 86              values(edr_process) as edr_process
 87              values(ProviderName) as provider_name
 88              values(FilterType) as filter_type
 89              values(FilterId) as filter_id
 90              values(LayerName) as layer_name
 91              values(LayerId) as layer_id
 92              values(Conditions) as conditions
 93              values(CalloutName) as callout_name
 94
 95BY dest user process_id FilterName
 96
 97
 98| `security_content_ctime(firstTime)`
 99
100| `security_content_ctime(lastTime)`
101
102| `windows_filtering_platform_filter_added_to_block_edr_process_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Security 5447	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Security'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
windows_filtering_platform_filter_added_to_block_edr_process_filter	`search *`

windows_filtering_platform_filter_added_to_block_edr_process_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1685	Disable or Modify Tools	Defense Impairment

Exploitation

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447. The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events.

Known False Positives

Legitimate firewall, VPN, EDR, and Group Policy changes can add WFP block filters. Tune by approved ProviderName, LayerName, FilterName, or known administrative windows after validating the WFP filter context.

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
Windows Filtering Platform block filter targeting [$edr_process$] was detected on [$dest$].	dest	system	50

Threat Objects

Field	Type
FilterName	signature
edr_process	process_name

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1