Adversaries can blind EDR products by applying Windows Firewall or Windows Filtering Platform (WFP) rules that block the EDR agent's network communications — without ever touching the EDR process directly. The post explains how these rules are stored in the registry, how tools like EDRSilencer and EDRSandblast exploit this, and proposes two defensive countermeasures: (1) kernel-level prevention using RegNtPreSetValueKey callbacks to block the registry writes, and (2) immediate removal using RegNtPostSetValueKey post-callbacks to detect and delete the offending rules at runtime via COM (INetFwRules::Remove) and WFP APIs (FwpmFilterDeleteById0, FwpmProviderDeleteByKey0). The author recommends the immediate-removal approach to avoid heavy kernel-side parsing, and notes that WFP security event 5447 can also serve as a detection trigger.
