❓Think your EDR solution is bullet proof?
🔥 Intuitive threat actors now leverage Windows Filtering Platform rules to block EDRs from alerting the SOC Team. ⬇️
⚙️ Specifically, EDRSilencer is a very neat opensource tool that detects running EDR processes and uses custom Windows Filtering Platform (WFP) rules to block outbound communications between the EDR agent on a workstation or sever to the EDR management server. This means that alerts don’t make it to the SOC team or IT department and are not aware of the system being compromised.
⬇️ EDRSilencer on Github:
https://github.com/netero1010/EDRSilencer
📰 Kudos to TrendMicro on their article covering this topic in detail:
https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html
🛡How to block this attack?
While TrendMicro notes that blocking EDRSilencer is one prevention method; there is nothing stopping threat actors from just crafting another app that calls WFP to block EDR agent communications. A better detection method for a SOC team would be to log WFP events and specifically alert on 5155 & 5157 event IDs (WFP blocked apps and connections) which are filtered in your SIEM platform by the Application Name which equals the path of your EDR agent.
📕WFP Event Auditing:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-filtering-platform-connection
Ref:https://www.linkedin.com/posts/christiancscott_think-your-edr-solution-is-bullet-proof-activity-7252879878260170753-XrF4/?utm_source=share&utm_medium=member_android
🔥 Intuitive threat actors now leverage Windows Filtering Platform rules to block EDRs from alerting the SOC Team. ⬇️
⚙️ Specifically, EDRSilencer is a very neat opensource tool that detects running EDR processes and uses custom Windows Filtering Platform (WFP) rules to block outbound communications between the EDR agent on a workstation or sever to the EDR management server. This means that alerts don’t make it to the SOC team or IT department and are not aware of the system being compromised.
⬇️ EDRSilencer on Github:
https://github.com/netero1010/EDRSilencer
📰 Kudos to TrendMicro on their article covering this topic in detail:
https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html
🛡How to block this attack?
While TrendMicro notes that blocking EDRSilencer is one prevention method; there is nothing stopping threat actors from just crafting another app that calls WFP to block EDR agent communications. A better detection method for a SOC team would be to log WFP events and specifically alert on 5155 & 5157 event IDs (WFP blocked apps and connections) which are filtered in your SIEM platform by the Application Name which equals the path of your EDR agent.
📕WFP Event Auditing:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-filtering-platform-connection
Ref:https://www.linkedin.com/posts/christiancscott_think-your-edr-solution-is-bullet-proof-activity-7252879878260170753-XrF4/?utm_source=share&utm_medium=member_android