HackTool - EDRSilencer Execution

Status: test
Severity: high
Log source: category process_creation, product windows
Author: @gott_cyber
Source: github.com/SigmaHQ/sigma

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: HackTool - EDRSilencer Execution
id: eb2d07d4-49cb-4523-801a-da002df36602
status: test
description: |
    Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.
references:
    - https://github.com/netero1010/EDRSilencer
author: '@gott_cyber'
date: 2024-01-02
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\EDRSilencer.exe'
        - OriginalFileName: 'EDRSilencer.exe'
        - Description|contains: 'EDRSilencer'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|endswith: '\EDRSilencer.exe'
    - OriginalFileName: 'EDRSilencer.exe'
    - Description|contains: 'EDRSilencer'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Description`	match	`EDRSilencer`	`field:"Description" kind:match value:"EDRSilencer"`
`Image`	ends_with	`\EDRSilencer.exe`	`field:"Image" kind:ends_with value:"\EDRSilencer.exe"`
`OriginalFileName`	eq	`EDRSilencer.exe`	`field:"OriginalFileName" kind:eq value:"EDRSilencer.exe"`