EDRSilencer: Disrupting EDR Communications with Windows Filtering Platform Rules

As Endpoint Detection and Response (EDR) solutions have become a standard defense mechanism in enterprise environments, attackers are continuously developing techniques to evade these defenses. One such tool is EDRSilencer, an open-source project designed to prevent EDR alerts from reaching their management servers by blocking outbound communications. Using custom Windows Filtering Platform (WFP) rules, EDRSilencer effectively silences EDR agents on compromised systems, leaving the SOC and IT departments unaware of the breach.

In this blog, we will explore how EDRSilencer works, the implications of its use for both offensive and defensive security teams, and provide recommendations on how to detect and mitigate this form of EDR evasion.

What is EDRSilencer?

EDRSilencer is a tool that detects running EDR processes on a compromised system and uses Windows Filtering Platform (WFP) rules to block outbound communications between the EDR agent and the EDR management server. The WFP is a set of API functions that allow filtering and modifying network traffic at the network stack level in Windows. By blocking the traffic from the EDR agent to the management server, EDRSilencer prevents alerts from being transmitted, effectively rendering the EDR solution silent.

This capability makes EDRSilencer highly effective at evading detection, as the SOC or IT department monitoring the EDR management console will not see any alerts or suspicious activity, allowing attackers to carry out their actions without fear of immediate detection.

How EDRSilencer Works

The core functionality of EDRSilencer revolves around two key techniques:

• Identifying EDR Processes: The tool scans the system for processes associated with known EDR agents, such as CrowdStrike, Carbon Black, Microsoft Defender ATP, and others. By identifying these processes, EDRSilencer targets the communication between the EDR agent and the management server.
• Blocking Outbound Communication Using WFP: Once the relevant EDR processes are identified, EDRSilencer uses Windows Filtering Platform (WFP) rules to block outbound traffic from the EDR agent to its management server. This ensures that no alerts or data are sent, preventing the SOC from detecting the compromise.

Offensive Security: Using EDRSilencer for Red Teaming

For red teamers and penetration testers, EDRSilencer provides a powerful method for neutralizing EDR solutions on target systems. By blocking EDR communications, attackers can avoid triggering alerts, giving them a significant advantage during their operations.

• Disabling EDR Alerts to Avoid Detection: One of the primary uses of EDRSilencer in offensive operations is to silence EDR solutions on compromised systems. By preventing alerts from reaching the SOC or IT teams, red teamers can freely conduct lateral movement, privilege escalation, or data exfiltration without immediate detection.
• Maintaining Stealth During Post-Exploitation: Once EDRSilencer has blocked EDR communications, attackers can maintain a stealthy presence on the compromised system. This is especially useful during post-exploitation activities, such as credential harvesting or persistence, where triggering alerts could lead to immediate response and containment.
• Testing EDR Resilience: Red teams can use EDRSilencer to assess how well an organization’s EDR solution detects and responds to network-based evasion techniques. This allows organizations to understand whether their EDR system can detect tampering with communication or whether additional defenses are needed to detect such evasion.

Defensive Security: Detecting and Mitigating EDRSilencer

While EDRSilencer presents a significant threat to endpoint security, defenders can take several steps to detect and mitigate its use. By focusing on network anomalies, process monitoring, and enhancing endpoint protection strategies, SOC teams can reduce the risk posed by tools like EDRSilencer.

• Monitoring for Network Anomalies: Since EDRSilencer disrupts communication between the EDR agent and the management server, defenders should monitor for signs of communication drop-offs from endpoints. Sudden loss of communication from a specific endpoint or group of endpoints may indicate that EDRSilencer or a similar evasion tool is in use.
• Monitoring Process Activity: Defenders should monitor for unusual activity around EDR processes, such as attempts to modify or suspend them. While EDRSilencer does not kill EDR processes, it does interact with them to identify which traffic to block.
• Monitoring WFP Rule Modifications: Since EDRSilencer relies on creating custom Windows Filtering Platform (WFP) rules, defenders can monitor for unauthorized or unexpected changes to the WFP. Any modification to WFP rules, especially those affecting EDR traffic, should be treated as suspicious.
• Enabling EDR Self-Protection Features: Many modern EDR solutions come with tamper protection features designed to prevent unauthorized modification of the agent or its communication channels. By enabling these features, defenders can reduce the effectiveness of tools like EDRSilencer.
• Employing Defense-in-Depth: As with most security defenses, a layered approach is critical. EDR is just one component of a broader security strategy. Network detection and response (NDR), identity and access management (IAM), and strict segmentation policies can all help mitigate the impact of a compromised EDR system.

Lessons from Past Incidents

EDR bypass and evasion tools have become increasingly popular in modern attack campaigns. In the NotPetya ransomware attack, for example, attackers disabled security solutions to avoid detection and response, allowing the ransomware to spread rapidly. Similarly, EDRSilencer enables attackers to fly under the radar by blocking the critical communication channels between EDR agents and their management servers.

Recommendations for Securing Endpoint Detection

• Monitor for Anomalous Network Behavior: Keep an eye on endpoints that suddenly stop sending logs or telemetry to the EDR management server.
• Monitor Process Behavior: Use process monitoring tools to detect unusual activity around EDR processes.
• Track WFP Modifications: Set up alerts for unauthorized changes to Windows Filtering Platform rules.
• Enable Tamper Protection: Ensure that tamper protection features are enabled on your EDR agents to prevent unauthorized modifications.
• Deploy a Defense-in-Depth Strategy: Combine EDR with network detection, identity management, and strong segmentation to ensure multiple layers of protection.

Final Thoughts

EDRSilencer demonstrates the increasing sophistication of tools designed to neutralize endpoint detection solutions. By understanding how these tools work and implementing proactive defenses, security teams can stay one step ahead of attackers seeking to compromise their systems undetected.

At Terraeagle, we specialize in helping organizations defend against advanced evasion techniques, including those that target EDR solutions. Reach out to us today to learn how we can help protect your infrastructure from evolving threats.