Query: write Sigma for Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (ED
Matching passage: Sigma rule: Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (ED. Logsource: windows / security. Rule: title: Windows Filtering Platform Blocked Connection From EDR Agent Binary id: bacf58c6-e199-4040-a94f-95dea0f1e45a status: test description: 'Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events. ' references: - https://github.com/netero1010/EDRSilencer - https://github.com/amjcyber/EDRNoiseMaker - https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983 author: '@gott_cyber' date: 2024-01-08 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Connection needs to be enabled' detection: selection: EventID: 5157 Application|endswith: - \AmSvc.exe - \cb.exe - \CETASvc.exe - \CNTAoSMgr.exe - \CrAmTray.exe - \CrsSvc.exe - \CSFalconContainer.exe - \CSFalconService.exe - \CybereasonAV.exe - \CylanceSvc.exe - \cyserver.exe - \CyveraService.exe - \CyvrFsFlt.exe - \EIConnector.exe - \elastic-agent.exe - \elastic-endpoint.exe - \EndpointBasecamp.exe - \ExecutionPreventionSvc.exe - \filebeat.exe - \fortiedr.exe - \hmpalert.exe - \hurukai.exe - \LogProcessorService.exe - \mcsagent.exe - \mcsclient.exe - \MsMpEng.exe - \MsSense.exe - \Ntrtscan.exe - \PccNTMon.exe - \QualysAgent.exe - \RepMgr.exe - \RepUtils.exe - \RepUx.exe - \RepWAV.exe - \RepWSC.exe - \sedservice.exe - \SenseCncProxy.exe - \SenseIR.exe - \SenseNdr.exe - \SenseSampleUploader.exe - \SentinelAgent.exe - \SentinelAgentWorker.exe - \SentinelBrowserNativeHost.exe - \SentinelHelperService.exe - \SentinelServiceHost.exe - \SentinelStaticEngine.exe - \SentinelStaticEngineScanner.exe - \sfc.exe - \sophos ui.exe - \sophosfilescanner.exe - \sophosfs.exe - \sophoshealth.exe - \sophosips.exe - \sophosLivequeryservice.exe - \sophosnetfilter.exe - \sophosntpservice.exe - \sophososquery.exe - \sspservice.exe - \TaniumClient.exe - \TaniumCX.exe - \TaniumDetectEngine.exe - \TMBMSRV.exe - \TmCCSF.exe - \TmListen.exe - \TmWSCSvc.exe - \Traps.exe - \winlogbeat.exe - \WSCommunicator.exe - \xagt.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actor. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Potential MeshAgent Execution - MacOS id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 related: - id: 2fbbe9ff-0afc-470b-bdc0-592198339968 type: similar status: experimental description: 'Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the ''--meshServiceName'' argument can indicate that the MeshAgent is being used for remote access. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: macos detection: selection: CommandLine|contains: --meshServiceName condition: selection falsepositives: - Environments that legitimately use MeshAgent level: medium