MalwareRansomware

EDRSilencer

EDRSilencer is a driverless Windows EDR killer and security-solution tampering tool designed to impair endpoint detection and response products by blocking their network communications rather than terminating them with a kernel driver. According to the provided content, it was inspired by MdSec NightHawk’s closed-source FireBlock tool and uses Windows Filtering Platform (WFP) APIs to identify running EDR processes and apply filters that block their outbound traffic, causing affected products to lose communication with their backends and potentially enter a "coma-like" state. Reported functionality includes searching for running EDR processes, adding WFP filters for specific processes, removing filters individually or globally, and a custom CreateFileW bypass to avoid file-handle access issues with EDR processes. The content states that it supports Microsoft Defender, Carbon Black, SentinelOne, and additional EDR products, and that it has been tested on Windows 10 and Windows Server 2016. ESET describes EDRSilencer as part of an emerging class of driverless EDR killers that ransomware actors are adopting quickly as a pre-encryption defense-evasion stage. Splunk published a detection for its execution on Windows, looking for EDRSilencer.exe or command lines containing "blockedr" while excluding "blockedreport," using telemetry such as CrowdStrike ProcessRollup2, Sysmon Event ID 1, and Windows Security Event ID 4688. A referenced public repository is github.com/netero1010/EDRSilencer.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Other

3 techniques

T1562Impair DefensesEvidence3

In this article I present a technique for interfering with the client–server connection of an EDR... Once an EDR agent loses contact with its server, much of its power is gone.

T1562.001Disable or Modify ToolsEvidence2

EDR killers terminate or suspend EDR/AV processes and services to bypass detection.

T1562.006Indicator BlockingEvidence1

Driverless EDR killers block telemetry and network communication (e.g., EDRSilencer).

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

splunk researchNews

Apr 13, 2026

Detection: Windows EDRSilencer Execution | Splunk Security Content

A Windows tool used to impair or silence EDR products by locating running EDR processes and applying Windows Filtering Platform filters to block their outbound traffic. It can add or remove filters and includes a custom method to bypass CreateFileW-related handle access issues.

the hacker newsNews

Mar 19, 2026

54 EDR Killers Use BYOVD to Exploit 34 Signed Vulnerable Drivers and Disable Security

A driverless EDR killer that blocks outbound traffic from EDR products, causing them to become ineffective or enter a coma-like state.

eset welivesecurity blogNews

Mar 19, 2026

EDR killers explained: Beyond the drivers

Driverless EDR killer that blocks communication between the endpoint and the security backend to impair defenses.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.