WFP Filter Added via Registry

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•1•0•2

Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.