Detection rules › Splunk
WFP Blocked Connection from EDR Agent (Windows Event Log)
Threat actors may abuse WFP filters to prevent EDR agents from reporting security events, as observed with tools like EDRSilencer or EDRNoisemaker. This use case detects when the Windows Filtering Platform blocks a connective event involving EDR binaries. Windows event 5157 is required for detection. Note: It is highly recommended that you specify only the binaries of EDR tools known to be used in your environment. This modification will greatly improve rule performance.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562 Impair Defenses |
References
- https://github.com/netero1010/EDRSilencer
- https://github.com/amjcyber/EDRNoiseMaker
- https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983
- https://detection.fyi/sigmahq/sigma/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked/
- https://www.huntress.com/blog/silencing-the-edr-silencers
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 5157 | The Windows Filtering Platform has blocked a connection. |
Rule body yaml
id: '38831.69927'
title: WFP Blocked Connection from EDR Agent
description: 'Threat actors may abuse WFP filters to prevent EDR agents from reporting
security events, as observed with tools like EDRSilencer or EDRNoisemaker. This
use case detects when the Windows Filtering Platform blocks a connective event involving
EDR binaries. Windows event 5157 is required for detection. Note: It is highly recommended
that you specify only the binaries of EDR tools known to be used in your environment.
This modification will greatly improve rule performance.'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5157) OR
"<EventID>5157<") ("AmSvc.exe" OR "cb.exe" OR "CETASvc.exe" OR "CNTAoSMgr.exe" OR
"CrAmTray.exe" OR "CrsSvc.exe" OR "CSFalconContainer.exe" OR "CSFalconService.exe"
OR "CybereasonAV.exe" OR "CylanceSvc.exe" OR "cyserver.exe" OR "CyveraService.exe"
OR "CyvrFsFlt.exe" OR "EIConnector.exe" OR "elastic-agent.exe" OR "elastic-endpoint.exe"
OR "EndpointBasecamp.exe" OR "ExecutionPreventionSvc.exe" OR "filebeat.exe" OR "fortiedr.exe"
OR "hmpalert.exe" OR "hurukai.exe" OR "LogProcessorService.exe" OR "mcsagent.exe"
OR "mcsclient.exe" OR "MsMpEng.exe" OR "MsSense.exe" OR "Ntrtscan.exe" OR "PccNTMon.exe"
OR "QualysAgent.exe" OR "RepMgr.exe" OR "RepUtils.exe" OR "RepUx.exe" OR "RepWAV.exe"
OR "RepWSC.exe" OR "sedservice.exe" OR "SenseCncProxy.exe" OR "SenseIR.exe" OR "SenseNdr.exe"
OR "SenseSampleUploader.exe" OR "SentinelAgent.exe" OR "SentinelAgentWorker.exe"
OR "SentinelBrowserNativeHost.exe" OR "SentinelHelperService.exe" OR "SentinelServiceHost.exe"
OR "SentinelStaticEngine.exe" OR "SentinelStaticEngineScanner.exe" OR "sfc.exe"
OR "sophosfilescanner.exe" OR "sophosfs.exe" OR "sophoshealth.exe" OR "sophosips.exe"
OR "sophosLivequeryservice.exe" OR "sophosnetfilter.exe" OR "sophosntpservice.exe"
OR "sophososquery.exe" OR "sspservice.exe" OR "TaniumClient.exe" OR "TaniumCX.exe"
OR "TaniumDetectEngine.exe" OR "TMBMSRV.exe" OR "TmCCSF.exe" OR "TmListen.exe" OR
"TmWSCSvc.exe" OR "Traps.exe" OR "winlogbeat.exe" OR "WSCommunicator.exe" OR "xagt.exe"
OR "MpCmdRun.exe" OR "MsMpEngCP.exe" OR "CrowdStrikeUI.exe" OR "cbstream.exe" OR
"cbnetwork.exe" OR "sfcMonitor.exe" OR "sfcService.exe" OR "SophosClean.exe" OR
"SophosUpdate.exe" OR "SentinelSystemMonitor.exe" OR "SentinelCleanup.exe" OR "mcshield.exe"
OR "mfemms.exe" OR "updaterui.exe" OR "smc.exe" OR "sepMasterService.exe" OR "avp.exe"
OR "avpui.exe" OR "cbresponse.exe" OR "cbservices.exe" OR "endpoint-security.exe"
OR "mbamservice.exe" OR "mbamtray.exe") | regex process_path="(?i)\x5c(AmSvc|cb|CETASvc|CNTAoSMgr|CrAmTray|CrsSvc|CSFalconContainer|CSFalconService|CybereasonAV|CylanceSvc|cyserver|CyveraService|CyvrFsFlt|EIConnector|elastic-agent|elastic-endpoint|EndpointBasecamp|ExecutionPreventionSvc|filebeat|fortiedr|hmpalert|hurukai|LogProcessorService|mcsagent|mcsclient|MsMpEng|MsSense|Ntrtscan|PccNTMon|QualysAgent|RepMgr|RepUtils|RepUx|RepWAV|RepWSC|sedservice|SenseCncProxy|SenseIR|SenseNdr|SenseSampleUploader|SentinelAgent|SentinelAgentWorker|SentinelBrowserNativeHost|SentinelHelperService|SentinelServiceHost|SentinelStaticEngine|SentinelStaticEngineScanner|sfc|sophosfilescanner|sophosfs|sophoshealth|sophosips|sophosLivequeryservice|sophosnetfilter|sophosntpservice|sophososquery|sspservice|TaniumClient|TaniumCX|TaniumDetectEngine|TMBMSRV|TmCCSF|TmListen|TmWSCSvc|Traps|winlogbeat|WSCommunicator|xagt|MpCmdRun|MsMpEngCP|CrowdStrikeUI|cbstream|cbnetwork|sfcMonitor|sfcService|SophosClean|SophosUpdate|SentinelSystemMonitor|SentinelCleanup|mcshield|mfemms|updaterui|smc|sepMasterService|avp|avpui|cbresponse|cbservices|endpoint-security|mbamservice|mbamtray)\.exe"
| table _time, host, user, process_* | bin span=1s | stats values(*) as * by _time,
host '
techniques:
- defense-evasion:impair defenses
technique_id:
- T1562
data_category:
- Windows event logs
references:
- https://github.com/netero1010/EDRSilencer
- https://github.com/amjcyber/EDRNoiseMaker
- https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983
- https://detection.fyi/sigmahq/sigma/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked/
- https://www.huntress.com/blog/silencing-the-edr-silencers
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5157) OR "<EventID>5157<") ("AmSvc.exe" OR "cb.exe" OR "CETASvc.exe" OR "CNTAoSMgr.exe" OR "CrAmTray.exe" OR "CrsSvc.exe" OR "CSFalconContainer.exe" OR "CSFalconService.exe" OR "CybereasonAV.exe" OR "CylanceSvc.exe" OR "cyserver.exe" OR "CyveraService.exe" OR "CyvrFsFlt.exe" OR "EIConnector.exe" OR "elastic-agent.exe" OR "elastic-endpoint.exe" OR "EndpointBasecamp.exe" OR "ExecutionPreventionSvc.exe" OR "filebeat.exe" OR "fortiedr.exe" OR "hmpalert.exe" OR "hurukai.exe" OR "LogProcessorService.exe" OR "mcsagent.exe" OR "mcsclient.exe" OR "MsMpEng.exe" OR "MsSense.exe" OR "Ntrtscan.exe" OR "PccNTMon.exe" OR "QualysAgent.exe" OR "RepMgr.exe" OR "RepUtils.exe" OR "RepUx.exe" OR "RepWAV.exe" OR "RepWSC.exe" OR "sedservice.exe" OR "SenseCncProxy.exe" OR "SenseIR.exe" OR "SenseNdr.exe" OR "SenseSampleUploader.exe" OR "SentinelAgent.exe" OR "SentinelAgentWorker.exe" OR "SentinelBrowserNativeHost.exe" OR "SentinelHelperService.exe" OR "SentinelServiceHost.exe" OR "SentinelStaticEngine.exe" OR "SentinelStaticEngineScanner.exe" OR "sfc.exe" OR "sophosfilescanner.exe" OR "sophosfs.exe" OR "sophoshealth.exe" OR "sophosips.exe" OR "sophosLivequeryservice.exe" OR "sophosnetfilter.exe" OR "sophosntpservice.exe" OR "sophososquery.exe" OR "sspservice.exe" OR "TaniumClient.exe" OR "TaniumCX.exe" OR "TaniumDetectEngine.exe" OR "TMBMSRV.exe" OR "TmCCSF.exe" OR "TmListen.exe" OR "TmWSCSvc.exe" OR "Traps.exe" OR "winlogbeat.exe" OR "WSCommunicator.exe" OR "xagt.exe" OR "MpCmdRun.exe" OR "MsMpEngCP.exe" OR "CrowdStrikeUI.exe" OR "cbstream.exe" OR "cbnetwork.exe" OR "sfcMonitor.exe" OR "sfcService.exe" OR "SophosClean.exe" OR "SophosUpdate.exe" OR "SentinelSystemMonitor.exe" OR "SentinelCleanup.exe" OR "mcshield.exe" OR "mfemms.exe" OR "updaterui.exe" OR "smc.exe" OR "sepMasterService.exe" OR "avp.exe" OR "avpui.exe" OR "cbresponse.exe" OR "cbservices.exe" OR "endpoint-security.exe" OR "mbamservice.exe" OR "mbamtray.exe")
Stage 2: regex
| regex process_path="(?i)\x5c(AmSvc|cb|CETASvc|CNTAoSMgr|CrAmTray|CrsSvc|CSFalconContainer|CSFalconService|CybereasonAV|CylanceSvc|cyserver|CyveraService|CyvrFsFlt|EIConnector|elastic-agent|elastic-endpoint|EndpointBasecamp|ExecutionPreventionSvc|filebeat|fortiedr|hmpalert|hurukai|LogProcessorService|mcsagent|mcsclient|MsMpEng|MsSense|Ntrtscan|PccNTMon|QualysAgent|RepMgr|RepUtils|RepUx|RepWAV|RepWSC|sedservice|SenseCncProxy|SenseIR|SenseNdr|SenseSampleUploader|SentinelAgent|SentinelAgentWorker|SentinelBrowserNativeHost|SentinelHelperService|SentinelServiceHost|SentinelStaticEngine|SentinelStaticEngineScanner|sfc|sophosfilescanner|sophosfs|sophoshealth|sophosips|sophosLivequeryservice|sophosnetfilter|sophosntpservice|sophososquery|sspservice|TaniumClient|TaniumCX|TaniumDetectEngine|TMBMSRV|TmCCSF|TmListen|TmWSCSvc|Traps|winlogbeat|WSCommunicator|xagt|MpCmdRun|MsMpEngCP|CrowdStrikeUI|cbstream|cbnetwork|sfcMonitor|sfcService|SophosClean|SophosUpdate|SentinelSystemMonitor|SentinelCleanup|mcshield|mfemms|updaterui|smc|sepMasterService|avp|avpui|cbresponse|cbservices|endpoint-security|mbamservice|mbamtray)\.exe"
Stage 3: table
| table _time, host, user, process_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
process_path | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>5157<" |
| 1 | "AmSvc.exe" |
| 1 | "cb.exe" |
| 1 | "CETASvc.exe" |
| 1 | "CNTAoSMgr.exe" |
| 1 | "CrAmTray.exe" |
| 1 | "CrsSvc.exe" |
| 1 | "CSFalconContainer.exe" |
| 1 | "CSFalconService.exe" |
| 1 | "CybereasonAV.exe" |
| 1 | "CylanceSvc.exe" |
| 1 | "cyserver.exe" |
| 1 | "CyveraService.exe" |
| 1 | "CyvrFsFlt.exe" |
| 1 | "EIConnector.exe" |
| 1 | "elastic-agent.exe" |
| 1 | "elastic-endpoint.exe" |
| 1 | "EndpointBasecamp.exe" |
| 1 | "ExecutionPreventionSvc.exe" |
| 1 | "filebeat.exe" |
| 1 | "fortiedr.exe" |
| 1 | "hmpalert.exe" |
| 1 | "hurukai.exe" |
| 1 | "LogProcessorService.exe" |
| 1 | "mcsagent.exe" |
| 1 | "mcsclient.exe" |
| 1 | "MsMpEng.exe" |
| 1 | "MsSense.exe" |
| 1 | "Ntrtscan.exe" |
| 1 | "PccNTMon.exe" |
| 1 | "QualysAgent.exe" |
| 1 | "RepMgr.exe" |
| 1 | "RepUtils.exe" |
| 1 | "RepUx.exe" |
| 1 | "RepWAV.exe" |
| 1 | "RepWSC.exe" |
| 1 | "sedservice.exe" |
| 1 | "SenseCncProxy.exe" |
| 1 | "SenseIR.exe" |
| 1 | "SenseNdr.exe" |
| 1 | "SenseSampleUploader.exe" |
| 1 | "SentinelAgent.exe" |
| 1 | "SentinelAgentWorker.exe" |
| 1 | "SentinelBrowserNativeHost.exe" |
| 1 | "SentinelHelperService.exe" |
| 1 | "SentinelServiceHost.exe" |
| 1 | "SentinelStaticEngine.exe" |
| 1 | "SentinelStaticEngineScanner.exe" |
| 1 | "sfc.exe" |
| 1 | "sophosfilescanner.exe" |
| 1 | "sophosfs.exe" |
| 1 | "sophoshealth.exe" |
| 1 | "sophosips.exe" |
| 1 | "sophosLivequeryservice.exe" |
| 1 | "sophosnetfilter.exe" |
| 1 | "sophosntpservice.exe" |
| 1 | "sophososquery.exe" |
| 1 | "sspservice.exe" |
| 1 | "TaniumClient.exe" |
| 1 | "TaniumCX.exe" |
| 1 | "TaniumDetectEngine.exe" |
| 1 | "TMBMSRV.exe" |
| 1 | "TmCCSF.exe" |
| 1 | "TmListen.exe" |
| 1 | "TmWSCSvc.exe" |
| 1 | "Traps.exe" |
| 1 | "winlogbeat.exe" |
| 1 | "WSCommunicator.exe" |
| 1 | "xagt.exe" |
| 1 | "MpCmdRun.exe" |
| 1 | "MsMpEngCP.exe" |
| 1 | "CrowdStrikeUI.exe" |
| 1 | "cbstream.exe" |
| 1 | "cbnetwork.exe" |
| 1 | "sfcMonitor.exe" |
| 1 | "sfcService.exe" |
| 1 | "SophosClean.exe" |
| 1 | "SophosUpdate.exe" |
| 1 | "SentinelSystemMonitor.exe" |
| 1 | "SentinelCleanup.exe" |
| 1 | "mcshield.exe" |
| 1 | "mfemms.exe" |
| 1 | "updaterui.exe" |
| 1 | "smc.exe" |
| 1 | "sepMasterService.exe" |
| 1 | "avp.exe" |
| 1 | "avpui.exe" |
| 1 | "cbresponse.exe" |
| 1 | "cbservices.exe" |
| 1 | "endpoint-security.exe" |
| 1 | "mbamservice.exe" |
| 1 | "mbamtray.exe" |