EDRSilencer！禁止EDR出站流量工具

https://www.mdsec.co.uk/2023/09/nighthawk-0-2-6-three-wise-monkeys/

搜索已知正在运行的EDR进程并添加WFP过滤器以阻止其出站流量为特定进程添加WFP过滤器删除此工具创建的所有WFP过滤器按过滤器ID删除特定的WFP过滤器支持使用内存中的PE执行模块在C2中运行（例如，BruteRatel's memexec）当进程试图获取其EDR进程的文件句柄（例如，通过CreateFileW）时，某些EDR控件（例如，microfilters）拒绝访问。然而，用于获取目标EDR进程的FWP应用程序id的FwpmGetAppIdFromFileName0 API在内部调用CreateFileW。为了避免这种情况，实现了自定义FwpmGetAppIdFromFileName0，以在不调用CreateFileW的情况下构造应用程序id，从而防止在向EDR进程添加WFP筛选器时出现意外故障

Microsoft Defender for Endpoint and Microsoft Defender AntivirusElastic EDRTrellix EDRQualys EDRSentinelOneCylanceCybereasonCarbon Black EDRCarbon Black CloudTaniumPalo Alto Networks Traps/Cortex XDRFortiEDRCisco Secure Endpoint (Formerly Cisco AMP)ESET InspectHarfanglab EDRTrendMicro Apex One

x86_64-w64-mingw32-gcc EDRSilencer.c utils.c -o EDRSilencer.exe -lfwpuclnt

Usage: EDRSilencer.exe <blockedr/block/unblockall/unblock>- Add WFP filters to block the IPv4 and IPv6 outbound traffic of all detected EDR processes:  EDRSilencer.exe blockedr- Add WFP filters to block the IPv4 and IPv6 outbound traffic of a specific process (full path is required):  EDRSilencer.exe block "C:WindowsSystem32curl.exe"- Remove all WFP filters applied by this tool:  EDRSilencer.exe unblockall- Remove a specific WFP filter based on filter id:  EDRSilencer.exe unblock <filter id>

EDRSilencer.exe blockedr