Skip to content
Threat Feed

Product

Elastic-Endpoint.exe

1 brief RSS
high advisory

Windows Filtering Platform Policy Added to Block EDR Process

Attackers modify the Windows Filtering Platform (WFP) policy to block the communication of endpoint detection and response (EDR) processes, impairing their functionality and hindering detection of malicious activities.

CylanceSvc.exe +15 edr-bypass defense-evasion wfp
2r 1t