Query: Sigma rule for Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (ED
Matching passage: Sigma rule: Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (ED. Logsource: windows / security. Rule: title: Windows Filtering Platform Blocked Connection From EDR Agent Binary id: bacf58c6-e199-4040-a94f-95dea0f1e45a status: test description: 'Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events. ' references: - https://github.com/netero1010/EDRSilencer - https://github.com/amjcyber/EDRNoiseMaker - https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983 author: '@gott_cyber' date: 2024-01-08 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Connection needs to be enabled' detection: selection: EventID: 5157 Application|endswith: - \AmSvc.exe - \cb.exe - \CETASvc.exe - \CNTAoSMgr.exe - \CrAmTray.exe - \CrsSvc.exe - \CSFalconContainer.exe - \CSFalconService.exe - \CybereasonAV.exe - \CylanceSvc.exe - \cyserver.exe - \CyveraService.exe - \CyvrFsFlt.exe - \EIConnector.exe - \elastic-agent.exe - \elastic-endpoint.exe - \EndpointBasecamp.exe - \ExecutionPreventionSvc.exe - \filebeat.exe - \fortiedr.exe - \hmpalert.exe - \hurukai.exe - \LogProcessorService.exe - \mcsagent.exe - \mcsclient.exe - \MsMpEng.exe - \MsSense.exe - \Ntrtscan.exe - \PccNTMon.exe - \QualysAgent.exe - \RepMgr.exe - \RepUtils.exe - \RepUx.exe - \RepWAV.exe - \RepWSC.exe - \sedservice.exe - \SenseCncProxy.exe - \SenseIR.exe - \SenseNdr.exe - \SenseSampleUploader.exe - \SentinelAgent.exe - \SentinelAgentWorker.exe - \SentinelBrowserNativeHost.exe - \SentinelHelperService.exe - \SentinelServiceHost.exe - \SentinelStaticEngine.exe - \SentinelStaticEngineScanner.exe - \sfc.exe - \sophos ui.exe - \sophosfilescanner.exe - \sophosfs.exe - \sophoshealth.exe - \sophosips.exe - \sophosLivequeryservice.exe - \sophosnetfilter.exe - \sophosntpservice.exe - \sophososquery.exe - \sspservice.exe - \TaniumClient.exe - \TaniumCX.exe - \TaniumDetectEngine.exe - \TMBMSRV.exe - \TmCCSF.exe - \TmListen.exe - \TmWSCSvc.exe - \Traps.exe - \winlogbeat.exe - \WSCommunicator.exe - \xagt.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use sc. Logsource: windows / network_connection. Rule: title: Outbound Network Connection Initiated By Script Interpreter id: 992a6cae-db6a-43c8-9cec-76d7195c96fc related: - id: 08249dc0-a28d-4555-8ba5-9255a198e08c type: derived status: test description: Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads. references: - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md author: frack113, Florian Roth (Nextron Systems) date: 2022-08-28 modified: 2024-03-13 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \wscript.exe - \cscript.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_main_ms_ranges: DestinationIp|cidr: 20.0.0.0/11 condition: selection and not 1 of filter_main_* falsepositives: - Legitimate scripts level: high