Record · corpus.blog/posts/01a07df5-21bb-71db-812f-ba0858291b8c

Filter-Mute Operation: Investigating EDR Internal Communication

SensePost · published 28 July 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at sensepost.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 43
Words captured: 2,877

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://www.signal-labs.com/blog/edr-observations

signal-labs.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/f15d938e919d8dfe34804af787f41e06.png

sensepost.com

https://www.ired.team/offensive-security/code-injection-process-injection/process-injection

ired.team

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/14b1e9a03d41357ac5c71e886d7d830c.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/4f9c9a56a0310d758f5bc9c0135fd289.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/5961f427d5cdf4cd04b1f157aa658441.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/f3bcc10f044d68a40be35be22cc83cf9.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/8d8dce9f8e4552b6902819218284faff.png

sensepost.com

https://synzack.github.io/Blinding-EDR-On-Windows/

synzack.github.io

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/e404e8d0497f08663f320d82c1d38694.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/f5e6884b37f842109d84265255497861.png

sensepost.com

https://windows-internals.com/investigating-filter-communication-ports/

windows-internals.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/0ebda443acc6f0a4510fa6d307706c1d.png

sensepost.com

https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nf-fltkernel-fltcreatecommunicationport

learn.microsoft.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/6a548fdb427af48cd2b8815168bc1af5.png

sensepost.com

https://www.youtube.com/watch?v=5HbmpPBKVFg

youtube.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/376fa461525cdfc002e4b7c9d8a7cb29.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/9af90226f2c91a46ae8f14f5ac54e661.png

sensepost.com

https://twitter.com/AliceCliment

twitter.com

https://alice.climent-pommeret.red/posts/process-killer-driver/

alice.climent-pommeret.red

https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber

ired.team

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/68c3efef60ba5a8c76eec62d8dd6ca78.png

sensepost.com

https://github.com/wavestone-cdt/EDRSandblast/

github.com

https://qazeer.io/

qazeer.io

https://twitter.com/th3m4ks

twitter.com

https://github.com/wavestone-cdt/EDRSandblast/pulls?q=is%3Apr+author%3Av1k1ngfr

github.com

https://github.com/wavestone-cdt/EDRSandblast/issues?q=is%3Aissue+author%3Av1k1ngfr

github.com

https://github.com/Orange-Cyberdefense/EDRSnowblast

github.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/8ca483f1322faa8dcd856dd1c66c1b9e.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/b7a2fd38ea2bd60e68c75a0be7e5de84.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/44a7e344271fc574676fb1410a44790c.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/d80ab3c0cdbfc55b54b7c77263dd5855.png

sensepost.com

https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules

learn.microsoft.com

https://www.loldrivers.io/

loldrivers.io

https://www.microsoft.com/en-us/security/blog/2020/07/08/

microsoft.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/b5918bcf08dd944b0f6f1631b7455bbc.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/8e30ad3c31798253d4a5156cf6f69083.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/4b2adee7539ea198f61443012f678819.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/56092ee6a791c3b039bed62354d778d6.png

sensepost.com

https://sensepost.com/img/pages/blog/2023/filter-mute-operation-investigating-edr-internal-communication/48e793022af38ddc8f27c0aa95def79b.png

sensepost.com

https://github.com/Orange-Cyberdefense/EDRSnowblast/blob/9953229180d3cc54132a374f42c6d977582be9ab/EDRSandblast/Utils/FltmgrOffsets.c

github.com

https://v1k1ngfr.github.io/edrsnowblast/

v1k1ngfr.github.io