Silent Threat: Red Team Tool EDRSilencer Disrupting Endpoint Security Solutions

EDRSilencer was originally developed as a red team tool, but this article documents the first observed cases of it being weaponized by real threat actors in the wild. The tool abuses the Windows Filtering Platform (WFP) — a legitimate Windows networking framework — to silently block EDR telemetry from reaching its cloud console. By inserting WFP filters, attackers effectively blind security teams without triggering alerts or crashing the EDR process. This research covers the technical mechanism, affected EDR products, detection strategies using ETW and kernel callbacks, and mitigation approaches. The article gained significant industry attention and was widely cited.