netero1010/EDRSilencer

Blocking doesn't work

Closed this issue · 3 comments

cookpoo78 commented

Hey,
Tried the release binary and also to compile my own (BTW, it was really challenging to compile successfully, GCC could not compile and VS required few modifications to succeed), and the WFP blocking doesn't effectively block the network traffic of the binary - I tried a number of binaries.
We can clearly see that the rule added successfully (e.g. by netsh wfp show state) but still the process can communicate.
image

netero1010 commented

Ping uses ICMP traffic and it is not handled by the FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer in the WFP. EDRSilencer uses FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer in the filter so ICMP traffic will not be restricted. You may try "C:\Windows\System32\curl.exe" for testing.

cookpoo78 commented

Still experiencing this problem...
image

netero1010 commented

Hi,

Can you double check if filters are actually added in your WFP? You may check it using "WFPExp.exe". Also, could you double check if there is any WFP allow rules particularly for powreshell?

I tried to perform your case in my environment but the blocking works from my side.
image