Windows Filtering Platform Policy Added to Block EDR Process

| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Registry where

Registry.action="modified"
Registry.registry_path="*\\Parameters\\FirewallPolicy\\FirewallRules*"
Registry.registry_value_data="*Action=Block*"
Registry.registry_value_data="*App=*"
Registry.registry_value_data IN (
    "*AmSvc.exe*",
    "*cb.exe*",
    "*CETASvc.exe*",
    "*CNTAoSMgr.exe*",
    "*CrAmTray.exe*",
    "*CrsSvc.exe*",
    "*CybereasonAV.exe*",
    "*CylanceSvc.exe*",
    "*cyserver.exe*",
    "*CyveraService.exe*",
    "*CyvrFsFlt.exe*",
    "*EIConnector.exe*",
    "*ekrn.exe*",
    "*elastic-agent.exe*",
    "*elastic-endpoint.exe*",
    "*EndpointBasecamp.exe*",
    "*ExecutionPreventionSvc.exe*",
    "*filebeat.exe*",
    "*fortiedr.exe*",
    "*hurukai.exe*",
    "*LogProcessorService.exe*",
    "*MsMpEng.exe*",
    "*MsSense.exe*",
    "*Ntrtscan.exe*",
    "*PccNTMon.exe*",
    "*QualysAgent.exe*",
    "*RepMgr.exe*",
    "*RepUtils.exe*",
    "*RepUx.exe*",
    "*RepWAV.exe*",
    "*RepWSC.exe*",
    "*SenseCncProxy.exe*",
    "*SenseIR.exe*",
    "*SenseNdr.exe*",
    "*SenseSampleUploader.exe*",
    "*SentinelAgent.exe*",
    "*SentinelAgentWorker.exe*",
    "*SentinelBrowserNativeHost.exe*",
    "*SentinelHelperService.exe*",
    "*SentinelServiceHost.exe*",
    "*SentinelStaticEngine.exe*",
    "*SentinelStaticEngineScanner.exe*",
    "*sfc.exe*",
    "*TaniumClient.exe*",
    "*TaniumCX.exe*",
    "*TaniumDetectEngine.exe*",
    "*TMBMSRV.exe*",
    "*TmCCSF.exe*",
    "*TmListen.exe*",
    "*TmWSCSvc.exe*",
    "*Traps.exe*",
    "*winlogbeat.exe*",
    "*WSCommunicator.exe*",
    "*xagt.exe*"
)

by Registry.dest Registry.vendor_product Registry.user Registry.status
   Registry.registry_value_name Registry.registry_path Registry.registry_hive
   Registry.registry_value_data Registry.action Registry.process_path
   Registry.process_guid Registry.process_id Registry.registry_key_name
| `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_filtering_platform_policy_added_to_block_edr_process_filter`

False Positives

• ⚠ Some legitimate administrative tasks or security configurations may create filtering platform policies. Verify actions with authorized IT personnel before alerting.