Microsoft Defender Component Outbound Network Connection Blocked (EDR silencer)
Detects instances where Windows Filtering Platform (WFP) has blocked outbound network connections initiated by critical Microsoft Defender components (e.g., MsSense.exe, MsMpEng.exe). Such blocks may indicate security software interference, misconfiguration, or attempts to disrupt endpoint security monitoring.
Microsoft Sentinel (KQL)
