You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hey,
Tried the release binary and also to compile my own (BTW, it was really challenging to compile successfully, GCC could not compile and VS required few modifications to succeed), and the WFP blocking doesn't effectively block the network traffic of the binary - I tried a number of binaries.
We can clearly see that the rule added successfully (e.g. by netsh wfp show state) but still the process can communicate.
The text was updated successfully, but these errors were encountered:
Ping uses ICMP traffic and it is not handled by the FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer in the WFP. EDRSilencer uses FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer in the filter so ICMP traffic will not be restricted. You may try "C:\Windows\System32\curl.exe" for testing.
Can you double check if filters are actually added in your WFP? You may check it using "WFPExp.exe". Also, could you double check if there is any WFP allow rules particularly for powreshell?
I tried to perform your case in my environment but the blocking works from my side.
Hey,
![image](https://private-user-images.githubusercontent.com/120901591/305694287-032d5c4f-d955-4b39-9803-e33087a6694e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ0MzQ2MTcsIm5iZiI6MTcyNDQzNDMxNywicGF0aCI6Ii8xMjA5MDE1OTEvMzA1Njk0Mjg3LTAzMmQ1YzRmLWQ5NTUtNGIzOS05ODAzLWUzMzA4N2E2Njk0ZS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwODIzJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDgyM1QxNzMxNTdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1iZDBmOGRiZjdlYzY1MTRlNjMwMTg3Y2NlY2FkNWY5MzEzZTE2MWRmYzQ5OTA5N2ZjZWMzOTM5MzhkN2RkYWY0JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.BoK-atwDAGXgXeS3ygpFadI_EHFvpBaWV_BOgrvZkmM)
Tried the release binary and also to compile my own (BTW, it was really challenging to compile successfully, GCC could not compile and VS required few modifications to succeed), and the WFP blocking doesn't effectively block the network traffic of the binary - I tried a number of binaries.
We can clearly see that the rule added successfully (e.g. by
netsh wfp show state
) but still the process can communicate.The text was updated successfully, but these errors were encountered: