Windows Filtering Platform Policy Added to Block EDR Process — Detection Rule
Detects the modification of a Windows Filtering Platform Policy to block the communication of known EDR processes. This can be used by attackers to impair the functionality of these tools and to hide their activities on the machine.