Sigma rule: WFP Filter Added via Registry

Rule

Title

WFP Filter Added via Registry

Status

experimental

Level

medium

Author

Frack113

Date

2025-10-23

File

rules/windows/registry/registry_set/registry_set_susp_wfp_filter_added.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: '\BFE\Parameters\Policy\Persistent\Filter\'
filter_main_svchost:
    Image:
        - 'C:\Windows\System32\svchost.exe'
        - 'C:\Windows\SysWOW64\svchost.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.defense-impairment
• attack.t1685
• attack.t1569.002

MITRE ATT&CK ids this rule names

• T1569.002
• T1685

References

• https://github.com/netero1010/EDRSilencer/blob/0e73a7037ec65c52894d8208e6f605a7da0a34a6/EDRSilencer.c
• https://www.huntress.com/blog/silencing-the-edr-silencers
• https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_susp_wfp_filter_added.yml