Skip to content

Hide Navigation Hide TOC

HackTool - NoFilter Execution (7b14c76a-c602-4ae6-9717-eff868153fc0)

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Cluster A Galaxy A Cluster B Galaxy B Level
Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d) Attack Pattern HackTool - NoFilter Execution (7b14c76a-c602-4ae6-9717-eff868153fc0) Sigma-Rules 1
Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48) Attack Pattern HackTool - NoFilter Execution (7b14c76a-c602-4ae6-9717-eff868153fc0) Sigma-Rules 1
Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48) Attack Pattern Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d) Attack Pattern 2