HackTool - EDRSilencer Execution

Title: HackTool - EDRSilencer Execution
Status: test
Description:Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.
References:
  -https://github.com/netero1010/EDRSilencer
Author: @gott_cyber
Date: 2024-01-02
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\EDRSilencer.exe' OriginalFileName:'EDRSilencer.exe' Description|contains:'EDRSilencer'   condition:selection
Falsepositives:
  -Unlikely
Level: high