EDRSilencerMalware
Trend Micro describes EDRSilencer as a red team tool originally designed to interfere with endpoint detection and response solutions via the Windows Filtering Platform, which is actively being used by threat actors.From MISP Galaxy
Last reported 5 months ago, by Huntress4 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1014Rootkit
“…g Your Own Vulnerable Driver (BYOVD), también vemos a los atacantes abusar con frecuencia de utilidades legítimas de anti‑rootkit o utilizar enfoques driverless para bloquear la comunicación del software de endpoint detection and response (EDR) o suspenderlo…”
- T1027Obfuscated Files or Information
“T1027”
- T1027.002Software Packing
“T1027.002”
- T1027.005Indicator Removal from Tools
“T1027.005”
- T1027.009Embedded Payloads
“T1027.009”
- T1037Boot or Logon Initialization Scripts
“Boot or Logon Initialization Scripts: Logon Script (Windows)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Threat Actor Defense Evasion: How Attackers Disable AV & EDR“Tools like EDRSandblast and EDRSilencer allow attackers to easily abuse Windows Firewall as part of their defense-evasion tradecraft.”
-
EDR killers explicados: Más allá de los drivers“Algunos ejemplos incluyen herramientas como EDRSilencer, que bloquea la comunicación entre un endpoint y su backend de seguridad, y EDR‑Freeze, que hace que los procesos de EDR se “cuelguen” o se vuelvan no responsivos.”
-
EDR killers explained: Beyond the drivers“Examples include tools like EDRSilencer, which blocks communication between an endpoint and its security backend, and EDR-Freeze, which causes EDR processes to “hang” or become unresponsive.”
-
Silencing the EDR Silencers“Many reading this blog have likely heard of EDRSilencer.”
Indicators in its reports
named in the reports above- 82ed942a52cdcf12…ba37619661a3in 2 reports
- 54547180a99474b0…8f3eea78b531in 2 reports
- 75f85caea52fe5a1…bd3161690addin 2 reports
- 002573d80091f7f8…2b85fa915f19in 2 reports
- 1e7567c0d525ad03…f40541994411in 2 reports
- 65c2388b0afb1d1f…d8d6cd8b5645in 2 reports
- a9f37104d2d89051…bff44d147e67in 2 reports
- 083f604377d74c43…e34ad7daceeain 2 reports
- 570161a420992280…800296b72d1cin 2 reports
- bbe0e14bc7ece8a7…0476cfcef110in 2 reports
- 31ce76931ca09d39…3bc72e6d647ein 2 reports
- b9820bf443c37557…e3a569a1b9e8in 2 reports
- 34270b07538b7357…8f234b602f93in 2 reports
- 09735640d6634b03…bc80f932126cin 2 reports
- 85bc0a4f67522d6a…5a2945ec5028in 2 reports
- 711c95fead2215e9…0d71ad5c5aa5in 2 reports
- bc65ed919988c8e4…45456601700ain 2 reports
- 148c0cde4f2ef807…0f4c519f47efin 2 reports
- 468121e7d6952799…937c4c5f92edin 2 reports
- c881f43c7fe94a6f…32fe56d8dd9cin 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.