Skip to content

Fix Windows EDRSilencer renamed binary detection coverage #4123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
raylee-hawkins wants to merge 1 commit into
base: develop
Choose a base branch
from
+8 −4
Open

Fix Windows EDRSilencer renamed binary detection coverage #4123

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions detections/endpoint/windows_edrsilencer_execution.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: Windows EDRSilencer Execution
id: a206324d-4945-4b0c-a731-87c311ddae2f
version: 2
version: 3
creation_date: '2026-05-05'
modification_date: '2026-05-13'
modification_date: '2026-06-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
Expand All @@ -13,6 +13,7 @@ description: |-
The tool includes a custom implementation to avoid file handle access issues with EDR processes by bypassing the CreateFileW API.
It supports a wide range of EDRs, including Microsoft Defender, Carbon Black, SentinelOne, and more, though further testing on various EDRs is recommended.
The tool has been tested on Windows 10 and Windows Server 2016, and its usage involves simple commands for blocking or unblocking traffic.
Renamed EDRSilencer binaries can still be identified by the blockedr command-line argument.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
Expand All @@ -27,7 +28,10 @@ search: |-
Processes.process_name="EDRSilencer.exe"
OR
(
Processes.process="*blockedr *"
(
Processes.process="* blockedr"
OR Processes.process="* blockedr *"
)
NOT Processes.process="*blockedreport*"
)

Expand All @@ -42,7 +46,7 @@ search: |-
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_edrsilencer_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, parent process, and complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Some legitimate administrative tools or security workflows may use similar techniques to block or filter EDR traffic for maintenance or troubleshooting. Verify the context and authorized use before flagging.
references:
- https://github.com/netero1010/EDRSilencer
Expand Down