Security researchers at Trend Micro reported in-the-wild deployments of EDRSilencer, an open-source tool repurposed by threat actors to suppress endpoint detection and response telemetry. Inspired by MDSec’s NightHawk FireBlock utility, the tool enumerates running processes against signatures for enterprise agents including Microsoft Defender for Endpoint, SentinelOne, CrowdStrike Falcon, and Carbon Black. Rather than attempting protected process termination or driver tampering, EDRSilencer leverages administrative access to interact directly with the Windows Filtering Platform (WFP) management engine via FwpmEngineOpen0 and FwpmFilterAdd0 APIs.

Executing the blockedr routine, the binary installs persistent WFP filters that drop all outbound IPv4 and IPv6 traffic bound for vendor telemetry endpoints. Because targeted agent processes and kernel-mode mini-filters remain running, local anti-tampering heuristics and service watchdogs fail to fire, blinding central SOC visibility while adversaries conduct lateral movement. Defenders can detect the technique by monitoring WFP filter registration under Windows Security Event ID 5448 and dropped traffic via Event ID 5157.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Abusing native Windows Filtering Platform APIs decouples telemetry suppression from process termination, bypassing endpoint self-defense hooks and tamper guards to isolate sensor communications without alerting kernel monitors.
• Bullet 2 — Strategic & Defender Imperative: Security teams must configure dead-man alerts within cloud EDR management consoles to detect missing heartbeats, audit WFP filter modifications using Event ID 5448, and restrict administrative privilege escalation.