Windows Filtering Platform Filter Added To Block EDR Process — Detection Rule
The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes. Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name. This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field.