360WFP_Exploit

360WFPExploit Una prueba de concepto PoC que demuestra el posible abuso de la interfaz del controlador WFP de 360 Security 360netmonx64wfp.sys, con el objetivo de verificar el riesgo de que las interfaces IOCTL sin autenticación del llamante puedan ser utilizadas indebidamente por programas de...

EDRPrison

EDRPrison Coautor: @oops4githttps://github.com/oops4git EDRPrison aprovecha un controlador WFP callout legítimo, WinDivert, para silenciar eficazmente los sistemas EDR. Inspirándose en herramientas como Shutter, FireBlock y EDRSilencer, este proyecto se centra en técnicas de evasión basadas en re...

EDRSilencer

EDRSilencer Inspirado en la herramienta de código cerrado FireBlock FireBlock de MdSec NightHawk, decidí crear mi propia versión y esta herramienta se creó con el objetivo de bloquear el tráfico saliente de los procesos EDR en ejecución mediante las APIs de Windows Filtering Platform WFP. Esta...

MINI-WFP7-WQ69-V568

Bulletin has no description...

EUVD-2026-22461

Use after free in Windows WFP NDIS Lightweight Filter Driver wfplwfs.sys allows an authorized attacker to elevate privileges locally...

Hackers Abuse EDRSilencer Tool to Bypass Security and Hide Malicious Activity

Threat actors are attempting to abuse the open-source EDRSilencer tool as part of efforts to tamper endpoint detection and response EDR solutions and hide malicious activity. Trend Micro said it detected "threat actors attempting to integrate EDRSilencer in their attacks, repurposing it as a mean...

October 10, 2023—KB5031364 (OS Build 20348.2031)

None None...

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform WFP to achieve privilege escalation in the Windows operating system. "If an attacker has the ability to execute code with admin privilege and the target is to perform LSASS Shtinkering,...

Understanding Network Access in Windows AppContainers

Posted by James Forshaw, Project Zero Recently I've been delving into the inner workings of the Windows Firewall. This is interesting to me as it's used to enforce various restrictions such as whether AppContainer sandboxed applications can access the network. Being able to bypass network...

A bypass the majority of antivirus software method-vulnerability warning-the black bar safety net

Brief description: Affected manufacturers:including but not limited to Kaspersky, 3 6 0, Baidu, Tencent, Swiss Star, Jiang min, AVG, nod32 Detailed description: Antivirus in the Proactive Defense when relying too heavily on WFP, the drain-proof the system its own file, resulting in the malicious...

CVE-2002-2132

CVE-2002-2132 concerns Windows File Protection (WFP) in Windows 2000 and XP. The vulnerability arises because WFP does not remove old security catalog (.CAT) files, enabling local attackers to replace legitimate, updated files with older, vulnerable versions that still have valid hash codes. The ...