Query: alert when Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (ED
Matching passage: Sigma rule: Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (ED. Logsource: windows / security. Rule: title: Windows Filtering Platform Blocked Connection From EDR Agent Binary id: bacf58c6-e199-4040-a94f-95dea0f1e45a status: test description: 'Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events. ' references: - https://github.com/netero1010/EDRSilencer - https://github.com/amjcyber/EDRNoiseMaker - https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983 author: '@gott_cyber' date: 2024-01-08 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Connection needs to be enabled' detection: selection: EventID: 5157 Application|endswith: - \AmSvc.exe - \cb.exe - \CETASvc.exe - \CNTAoSMgr.exe - \CrAmTray.exe - \CrsSvc.exe - \CSFalconContainer.exe - \CSFalconService.exe - \CybereasonAV.exe - \CylanceSvc.exe - \cyserver.exe - \CyveraService.exe - \CyvrFsFlt.exe - \EIConnector.exe - \elastic-agent.exe - \elastic-endpoint.exe - \EndpointBasecamp.exe - \ExecutionPreventionSvc.exe - \filebeat.exe - \fortiedr.exe - \hmpalert.exe - \hurukai.exe - \LogProcessorService.exe - \mcsagent.exe - \mcsclient.exe - \MsMpEng.exe - \MsSense.exe - \Ntrtscan.exe - \PccNTMon.exe - \QualysAgent.exe - \RepMgr.exe - \RepUtils.exe - \RepUx.exe - \RepWAV.exe - \RepWSC.exe - \sedservice.exe - \SenseCncProxy.exe - \SenseIR.exe - \SenseNdr.exe - \SenseSampleUploader.exe - \SentinelAgent.exe - \SentinelAgentWorker.exe - \SentinelBrowserNativeHost.exe - \SentinelHelperService.exe - \SentinelServiceHost.exe - \SentinelStaticEngine.exe - \SentinelStaticEngineScanner.exe - \sfc.exe - \sophos ui.exe - \sophosfilescanner.exe - \sophosfs.exe - \sophoshealth.exe - \sophosips.exe - \sophosLivequeryservice.exe - \sophosnetfilter.exe - \sophosntpservice.exe - \sophososquery.exe - \sspservice.exe - \TaniumClient.exe - \TaniumCX.exe - \TaniumDetectEngine.exe - \TMBMSRV.exe - \TmCCSF.exe - \TmListen.exe - \TmWSCSvc.exe - \Traps.exe - \winlogbeat.exe - \WSCommunicator.exe - \xagt.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN i. Logsource: windows / network_connection. Rule: title: Network Connection Initiated By IMEWDBLD.EXE id: 8d7e392e-9b28-49e1-831d-5949c6281228 related: - id: 863218bd-c7d0-4c52-80cd-0a96c09f54af type: derived status: test description: 'Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/ author: frack113 date: 2022-01-22 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \IMEWDBLD.exe condition: selection falsepositives: - Unknown level: high