legitimate firewall, vpn, edr, and group policy changes can add wfp block filters. tune by approved providername, layername, filtername, or known administrative windows after validating the wfp filter context.

splunk

Techniques

Sample rules

Windows Filtering Platform Filter Added To Block EDR Process

source: splunk
technicques:

Description

The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes. Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name. This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field.

Detection logic

`wineventlog_security`
EventCode=5447
ChangeType IN ("%%16384", "Add")
Action IN ("%%16389", "Block")
Conditions=*


| eval conditions_text=coalesce(Conditions,"")

| rex mode=sed field=conditions_text "s/-/ /g"

| rex mode=sed field=conditions_text "s/[0-9A-Fa-f]{8}\s+([0-9A-Fa-f]{2}\s+){1,16}//g"

| eval conditions_normalized=lower(replace(conditions_text, "[^A-Za-z0-9]", ""))

| eval edr_process=case(
        like(conditions_normalized, "%msmpengexe%"), "MsMpEng.exe",
        like(conditions_normalized, "%mssenseexe%"), "MsSense.exe",
        like(conditions_normalized, "%senseirexe%"), "SenseIR.exe",
        like(conditions_normalized, "%sensendrexe%"), "SenseNdr.exe",
        like(conditions_normalized, "%sensecncproxyexe%"), "SenseCncProxy.exe",
        like(conditions_normalized, "%sensesampleuploaderexe%"), "SenseSampleUploader.exe",
        like(conditions_normalized, "%winlogbeatexe%"), "winlogbeat.exe",
        like(conditions_normalized, "%elasticagentexe%"), "elastic-agent.exe",
        like(conditions_normalized, "%elasticendpointexe%"), "elastic-endpoint.exe",
        like(conditions_normalized, "%filebeatexe%"), "filebeat.exe",
        like(conditions_normalized, "%xagtexe%"), "xagt.exe",
        like(conditions_normalized, "%qualysagentexe%"), "QualysAgent.exe",
        like(conditions_normalized, "%sentinelagentexe%"), "SentinelAgent.exe",
        like(conditions_normalized, "%sentinelagentworkerexe%"), "SentinelAgentWorker.exe",
        like(conditions_normalized, "%sentinelservicehostexe%"), "SentinelServiceHost.exe",
        like(conditions_normalized, "%sentinelstaticengineexe%"), "SentinelStaticEngine.exe",
        like(conditions_normalized, "%logprocessorserviceexe%"), "LogProcessorService.exe",
        like(conditions_normalized, "%sentinelstaticenginescannerexe%"), "SentinelStaticEngineScanner.exe",
        like(conditions_normalized, "%sentinelhelperserviceexe%"), "SentinelHelperService.exe",
        like(conditions_normalized, "%sentinelbrowsernativehostexe%"), "SentinelBrowserNativeHost.exe",
        like(conditions_normalized, "%cylancesvcexe%"), "CylanceSvc.exe",
        like(conditions_normalized, "%amsvcexe%"), "AmSvc.exe",
        like(conditions_normalized, "%cramtrayexe%"), "CrAmTray.exe",
        like(conditions_normalized, "%crssvcexe%"), "CrsSvc.exe",
        like(conditions_normalized, "%executionpreventionsvcexe%"), "ExecutionPreventionSvc.exe",
        like(conditions_normalized, "%cybereasonavexe%"), "CybereasonAV.exe",
        like(conditions_normalized, "%cbexe%"), "cb.exe",
        like(conditions_normalized, "%repmgrexe%"), "RepMgr.exe",
        like(conditions_normalized, "%reputilsexe%"), "RepUtils.exe",
        like(conditions_normalized, "%repuxexe%"), "RepUx.exe",
        like(conditions_normalized, "%repwavexe%"), "RepWAV.exe",
        like(conditions_normalized, "%repwscexe%"), "RepWSC.exe",
        like(conditions_normalized, "%taniumclientexe%"), "TaniumClient.exe",
        like(conditions_normalized, "%taniumcxexe%"), "TaniumCX.exe",
        like(conditions_normalized, "%taniumdetectengineexe%"), "TaniumDetectEngine.exe",
        like(conditions_normalized, "%trapsexe%"), "Traps.exe",
        like(conditions_normalized, "%cyserverexe%"), "cyserver.exe",
        like(conditions_normalized, "%cyveraserviceexe%"), "CyveraService.exe",
        like(conditions_normalized, "%cyvrfsfltexe%"), "CyvrFsFlt.exe",
        like(conditions_normalized, "%fortiedrexe%"), "fortiedr.exe",
        like(conditions_normalized, "%sfcexe%"), "sfc.exe",
        like(conditions_normalized, "%eiconnectorexe%"), "EIConnector.exe",
        like(conditions_normalized, "%ekrnexe%"), "ekrn.exe",
        like(conditions_normalized, "%hurukaiexe%"), "hurukai.exe",
        like(conditions_normalized, "%cetasvcexe%"), "CETASvc.exe",
        like(conditions_normalized, "%wscommunicatorexe%"), "WSCommunicator.exe",
        like(conditions_normalized, "%endpointbasecampexe%"), "EndpointBasecamp.exe",
        like(conditions_normalized, "%tmlistenexe%"), "TmListen.exe",
        like(conditions_normalized, "%ntrtscanexe%"), "Ntrtscan.exe",
        like(conditions_normalized, "%tmwscsvcexe%"), "TmWSCSvc.exe",
        like(conditions_normalized, "%pccntmonexe%"), "PccNTMon.exe",
        like(conditions_normalized, "%tmbmsrvexe%"), "TMBMSRV.exe",
        like(conditions_normalized, "%cntaosmgrexe%"), "CNTAoSMgr.exe",
        like(conditions_normalized, "%tmccsfexe%"), "TmCCSF.exe"
    )

| where isnotnull(edr_process)

| eval user=coalesce(UserName,user,"unknown")


| eval filter_action=case(Action="%%16389","Block", true(), Action),
        change_type=case(ChangeType="%%16384","Add", true(), ChangeType)


| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(filter_action) as filter_action
              values(change_type) as change_type
              values(edr_process) as edr_process
              values(ProviderName) as provider_name
              values(FilterType) as filter_type
              values(FilterId) as filter_id
              values(LayerName) as layer_name
              values(LayerId) as layer_id
              values(Conditions) as conditions
              values(CalloutName) as callout_name

BY dest user process_id FilterName


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_filtering_platform_filter_added_to_block_edr_process_filter`