this filter name is associated with edrsilencer behavior. validate whether any approved administrative tooling creates wfp block filters with the same name before tuning.

splunk

Techniques

Sample rules

Windows EDRSilencer Custom Outbound Filter Added

source: splunk
technicques:

Description

The following analytic detects the EDRSilencer-specific Windows Filtering Platform filter name “Custom Outbound Filter” when it is configured with a block action. EDRSilencer creates WFP filters to block outbound traffic from EDR and security agent processes, impairing endpoint telemetry without requiring the tool binary to keep its original process name. EventCode 5447 identifies creation of the runtime filter with ChangeType %%16384, while EventCode 5441 can show the same persistent filter when the Base Filtering Engine starts.

Detection logic

`wineventlog_security`
(
    (
        (
            EventCode=5447
            ChangeType IN ("%%16384", "Add")
        )
        OR
        EventCode=5441
    )
    Action IN ("%%16389", "Block")
    FilterName="Custom Outbound Filter"
)


| eval user=coalesce(UserName,user,"unknown")

| eval filter_action=case(Action="%%16389","Block", true(), Action),
       change_type=case(ChangeType="%%16384","Add", true(), ChangeType)


| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(filter_action) as filter_action
              values(change_type) as change_type
              values(ProviderName) as provider_name
              values(FilterType) as filter_type
              values(FilterId) as filter_id
              values(FilterKey) as filter_key
              values(LayerName) as layer_name
              values(LayerId) as layer_id
              values(Conditions) as conditions
              values(CalloutName) as callout_name
  BY dest user process_id FilterName

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_edrsilencer_custom_outbound_filter_added_filter`