Hayabusa medium experimental sigma

WFP Filter Added via Registry

Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.

View Source

Detection Logic

{
  "registry_set": {
    "EventID": 4657,
    "Channel": "Security"
  },
  "selection": {
    "ObjectName
| contains": "\\BFE\\Parameters\\Policy\\Persistent\\Filter\\"
  },
  "filter_main_svchost": {
    "ProcessName": [
      "C:\\Windows\\System32\\svchost.exe",
      "C:\\Windows\\SysWOW64\\svchost.exe"
    ]
  },
  "condition": "registry_set and (selection and not 1 of filter_main_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...