Skip to content

Hide Navigation Hide TOC

WFP Filter Added via Registry (1f1d8209-636e-4c6c-a137-781cca8b82f9)

Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.

Cluster A Galaxy A Cluster B Galaxy B Level
Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4) Attack Pattern WFP Filter Added via Registry (1f1d8209-636e-4c6c-a137-781cca8b82f9) Sigma-Rules 1
Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern WFP Filter Added via Registry (1f1d8209-636e-4c6c-a137-781cca8b82f9) Sigma-Rules 1
Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4) Attack Pattern System Services - T1569 (d157f9d2-d09a-4efa-bb2a-64963f94e253) Attack Pattern 2