WFP Filter Added via Registry
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events. This rule specifically looks for modifications to the 'Filter' subkey within the WFP policy parameters in the registry, while excluding modifications made by svchost.exe to reduce false positives.
Sigma
