Sigma rule: Windows Filtering Platform Blocked Connection From EDR Agent Binary

Rule

Title

Windows Filtering Platform Blocked Connection From EDR Agent Binary

Status

test

Level

high

Author

@gott_cyber

Date

2024-01-08

File

rules/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Log source

product

windows

service

security

definition

Requirements: Audit Filtering Platform Connection needs to be enabled

Detection

selection:
    EventID: 5157
    Application|endswith:
        - '\AmSvc.exe' # Cybereason
        - '\cb.exe' # Carbon Black EDR
        - '\CETASvc.exe' # TrendMicro Apex One
        - '\CNTAoSMgr.exe' # TrendMicro Apex One
        - '\CrAmTray.exe' # Cybereason
        - '\CrsSvc.exe' # Cybereason
        - '\CSFalconContainer.exe' # CrowdStrike Falcon
        - '\CSFalconService.exe' # CrowdStrike Falcon
        - '\CybereasonAV.exe' # Cybereason
        - '\CylanceSvc.exe' # Cylance
        - '\cyserver.exe' # Palo Alto Networks Traps/Cortex XDR
        - '\CyveraService.exe' # Palo Alto Networks Traps/Cortex XDR
        - '\CyvrFsFlt.exe' # Palo Alto Networks Traps/Cortex XDR
        - '\EIConnector.exe' # ESET Inspect
        - '\elastic-agent.exe' # Elastic EDR
        - '\elastic-endpoint.exe' # Elastic EDR
        - '\EndpointBasecamp.exe' # TrendMicro Apex One
        - '\ExecutionPreventionSvc.exe' # Cybereason
        - '\filebeat.exe' # Elastic EDR
        - '\fortiedr.exe' # FortiEDR
        - '\hmpalert.exe' # Sophos EDR
        - '\hurukai.exe' # Harfanglab EDR
        - '\LogProcessorService.exe' # SentinelOne
        - '\mcsagent.exe' # Sophos EDR
        - '\mcsclient.exe' # Sophos EDR
        - '\MsMpEng.exe' # Microsoft Defender for Endpoint and Microsoft Defender Antivirus
        - '\MsSense.exe' # Microsoft Defender for Endpoint and Microsoft Defender Antivirus
        - '\Ntrtscan.exe' # TrendMicro Apex One
        - '\PccNTMon.exe' # TrendMicro Apex One
        - '\QualysAgent.exe' # Qualys EDR
        - '\RepMgr.exe' # Carbon Black Cloud
        - '\RepUtils.exe' # Carbon Black Cloud
        - '\RepUx.exe' # Carbon Black Cloud
        - '\RepWAV.exe' # Carbon Black Cloud
        - '\RepWSC.exe' # Carbon Black Cloud
        - '\sedservice.exe' # Sophos EDR
        - '\SenseCncProxy.exe' # Microsoft Defender for Endpoint and Microsoft Defender Antivirus
        - '\SenseIR.exe' # Microsoft Defender for Endpoint and Microsoft Defender Antivirus
        - '\SenseNdr.exe' # Microsoft Defender for Endpoint and Microsoft Defender Antivirus
        - '\SenseSampleUploader.exe' # Microsoft Defender for Endpoint and Microsoft Defender Antivirus
        - '\SentinelAgent.exe' # SentinelOne
        - '\SentinelAgentWorker.exe' # SentinelOne
        - '\SentinelBrowserNativeHost.exe' # SentinelOne
        - '\SentinelHelperService.exe' # SentinelOne
        - '\SentinelServiceHost.exe' # SentinelOne
        - '\SentinelStaticEngine.exe' # SentinelOne
        - '\SentinelStaticEngineScanner.exe' # SentinelOne
        - '\sfc.exe' # Cisco Secure Endpoint (Formerly Cisco AMP)
        - '\sophos ui.exe' # Sophos EDR
        - '\sophosfilescanner.exe' # Sophos EDR
        - '\sophosfs.exe' # Sophos EDR
        - '\sophoshealth.exe' # Sophos EDR
        - '\sophosips.exe' # Sophos EDR
        - '\sophosLivequeryservice.exe' # Sophos EDR
        - '\sophosnetfilter.exe' # Sophos EDR
        - '\sophosntpservice.exe' # Sophos EDR
        - '\sophososquery.exe' # Sophos EDR
        - '\sspservice.exe' # Sophos EDR
        - '\TaniumClient.exe' # Tanium
        - '\TaniumCX.exe' # Tanium
        - '\TaniumDetectEngine.exe' # Tanium
        - '\TMBMSRV.exe' # TrendMicro Apex One
        - '\TmCCSF.exe' # TrendMicro Apex One
        - '\TmListen.exe' # TrendMicro Apex One
        - '\TmWSCSvc.exe' # TrendMicro Apex One
        - '\Traps.exe' # Palo Alto Networks Traps/Cortex XDR
        - '\winlogbeat.exe' # Elastic EDR
        - '\WSCommunicator.exe' # TrendMicro Apex One
        - '\xagt.exe' # Trellix EDR
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

References

• https://github.com/netero1010/EDRSilencer
• https://github.com/amjcyber/EDRNoiseMaker
• https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml