Full Report
Discover how adversaries are using tools like EDRSilencer to tamper with EDR communications and learn how you can fight back.
Analysis Summary
# Tool/Technique: EDRSilencer / Firewall-Based EDR Blinding
## Overview
EDRSilencer is an open-source attack tool designed to "blind" Endpoint Detection and Response (EDR) agents. Rather than terminating the EDR process—which often triggers an immediate alert—this tool leverages the Windows Filtering Platform (WFP) to block the EDR's outbound network communications. This prevents telemetry, alerts, and heartbeats from reaching the security console, effectively neutralizing the EDR while the process appears to remain "running."
## Technical Details
- **Type:** Attack Tool / Evasion Technique
- **Platform:** Windows (7, 8.1, 10, 11, and Server variants)
- **Capabilities:** Identifies running EDR processes and programmatically creates WFP filters to block their traffic.
- **First Seen:** Public GitHub release circa 2023 (based on development history).
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- **T1562 - Impair Defenses**
- **T1562.004 - Impair Defenses: Indicator Blocking**
- **TA0011 - Command and Control**
- **T1571 - Non-Standard Port** (Technique bypasses standard reporting ports)
## Functionality
### Core Capabilities
- **WFP Integration:** Uses the Windows Filtering Platform API (`FwpmFilterAdd0`) to create persistent or dynamic network filters.
- **EDR Identification:** Contains a hardcoded list of known EDR executable names (e.g., `MsSense.exe`, `Cyborg.exe`, `SentinelAgent.exe`).
- **Outbound Blocking:** Silently drops all outbound packets originating from the identified security binaries.
### Advanced Features
- **Non-Destructive Evasion:** Avoids traditional "Kill" methods that trigger Protected Process Light (PPL) protections or "Process Terminated" alerts.
- **Custom Rule Creation:** Can be modified to target any specific process path or PID to isolate it from the network.
## Indicators of Compromise
- **File Names:** `EDRSilencer.exe` (though often renamed by attackers).
- **Registry Keys:**
- `HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{GUID}`
- **Behavioral Indicators:**
- Presence of many new WFP filters with a "Block" action.
- Unexpected silence from an endpoint that is otherwise active.
- Use of `netsh advfirewall` commands to block specific application paths.
## Associated Threat Actors
- Broadly used by **Red Teamers** and **Penetration Testers**.
- Observed in use by various ransomware affiliates and sophisticated threat actors to maintain persistence after gaining local administrator privileges.
## Detection Methods
- **Behavioral Detection:** Monitor for calls to WFP functions (`FwpmFilterAdd0`) from unsigned or unexpected binaries.
- **Audit Logs:** Enable "Audit Filtering Platform Policy Change" (Event ID 5447) to track the creation of new filters.
- **State Monitoring:** Implement "Deadman Switches" where the management console alerts if an agent stops checking in despite the host being online.
- **Registry Monitoring:** Monitor the `FirewallRules` registry path for unauthorized modifications targeting security software directories.
## Mitigation Strategies
- **Least Privilege:** Restrict local administrator rights; WFP modification requires elevated privileges.
- **Tamper Protection:** Enable vendor-specific tamper protection that monitors for firewall rule changes targeting its own binaries.
- **Endpoint Hardening:** Use AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of known bypass tools like EDRSilencer.
## Related Tools/Techniques
- **EDRSandblast:** Uses COM interfaces (`INetFwRules`) to add firewall blocks.
- **Defendnot:** Bypasses Windows Defender using undocumented APIs.
- **BYOVD (Bring Your Own Vulnerable Driver):** Sometimes used to disable WFP callouts at the kernel level.