360WFP_Exploit

360WFPExploit 一个概念验证（PoC），演示对 360 安全卫士 WFP 驱动（360netmonx64wfp.sys） 接口的潜在滥用，旨在验证缺少调用者身份验证的 IOCTL 接口可能被第三方程序滥用的风险。 本项目仅用于安全研究和漏洞分析，禁止用于任何非法用途。 项目概述 在对 360 安全卫士网络监控驱动 360netmonx64wfp.sys 进行逆向分析时，发现以下行为： 该驱动向用户态暴露了两个设备对象： \.\360TdiFilter \.\360TdiSpeed 任何拥有管理员权限的进程均可通过 DeviceIoControl 访问这些设备对象...

EDRPrison

EDRPrison 联合作者：@oops4githttps://github.com/oops4git EDRPrison 利用合法的 WFP 标注驱动程序 WinDivert 来有效静默 EDR 系统。该项目借鉴了 Shutter、FireBlock 和 EDRSilencer 等工具的思路，专注于基于网络的规避技术。与之前的工具不同，EDRPrison 安装并加载一个外部合法的 WFP 标注驱动程序，而不是仅依赖内置的 WFP。此外，它通过动态添加运行时过滤器来阻止 EDR 进程的出站流量，而无需直接与 EDR 进程或其可执行文件交互。 总之，EDRPrison 具有以下关键特性和能...

EDRSilencer

EDRSilencer 受 MdSec NightHawk 闭源工具 FireBlock FireBlock 的启发，我决定创建自己的版本。该工具旨在使用 Windows 筛选平台（WFP）API 阻止正在运行的 EDR 进程的对外流量。 该工具提供以下功能： 搜索已知正在运行的 EDR 进程，并添加 WFP 筛选器以阻止其对外流量 为特定进程添加 WFP 筛选器 移除该工具创建的所有 WFP 筛选器 按筛选器 ID 移除特定的 WFP 筛选器 支持在 C2 中通过内存 PE 执行模块运行（例如 BruteRatel's memexec） 某些 EDR 控制机制（例如...

MINI-WFP7-WQ69-V568

Bulletin has no description...

EUVD-2026-22461

Use after free in Windows WFP NDIS Lightweight Filter Driver wfplwfs.sys allows an authorized attacker to elevate privileges locally...

Hackers Abuse EDRSilencer Tool to Bypass Security and Hide Malicious Activity

Threat actors are attempting to abuse the open-source EDRSilencer tool as part of efforts to tamper endpoint detection and response EDR solutions and hide malicious activity. Trend Micro said it detected "threat actors attempting to integrate EDRSilencer in their attacks, repurposing it as a mean...

October 10, 2023—KB5031364 (OS Build 20348.2031)

None None...

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform WFP to achieve privilege escalation in the Windows operating system. "If an attacker has the ability to execute code with admin privilege and the target is to perform LSASS Shtinkering,...

Understanding Network Access in Windows AppContainers

Posted by James Forshaw, Project Zero Recently I've been delving into the inner workings of the Windows Firewall. This is interesting to me as it's used to enforce various restrictions such as whether AppContainer sandboxed applications can access the network. Being able to bypass network...

A bypass the majority of antivirus software method-vulnerability warning-the black bar safety net

Brief description: Affected manufacturers:including but not limited to Kaspersky, 3 6 0, Baidu, Tencent, Swiss Star, Jiang min, AVG, nod32 Detailed description: Antivirus in the Proactive Defense when relying too heavily on WFP, the drain-proof the system its own file, resulting in the malicious...

CVE-2002-2132

CVE-2002-2132 concerns Windows File Protection (WFP) in Windows 2000 and XP. The vulnerability arises because WFP does not remove old security catalog (.CAT) files, enabling local attackers to replace legitimate, updated files with older, vulnerable versions that still have valid hash codes. The ...