# netero1010/EDRSilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

Repository: https://github.com/netero1010/EDRSilencer
Canonical: https://ross.abutalabs.com/products/edrsilencer
Language: C
License: MIT
License Family: permissive
Last push: 2024-11-03T16:05:14+00:00

## Health v2 (maintenance only)
Score: 17/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 70
- inputs: {"age_days": 981, "days_push": 668, "days_rel": 668, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1899, forks 246 (observed 2026-08-28T04:05:51.402662+00:00)

## What it is
A C-based Windows command-line tool that uses Windows Filtering Platform (WFP) APIs to block outbound traffic of running EDR agents, preventing them from reporting security events to their servers. It supports many commercial EDR products and can be executed in-memory from C2 frameworks.

## Use cases
- block edr agents from reporting to their server
- silence endpoint detection and response telemetry during red team ops
- add wfp filters to block outbound traffic of a specific process
- enumerate running edr processes on a windows host
- remove wfp filters created by the tool
- test edr resilience against traffic blocking

## When to choose
- you are a red teamer or penetration tester needing to suppress EDR alerting during authorized engagements
- you need a lightweight open-source alternative to commercial tools like FireBlock
- you want to block outbound traffic of arbitrary processes via WFP on Windows

## When to avoid
- you need a defensive tool to protect or monitor EDR agents
- you require stealth features or C2 integration beyond in-memory PE execution
- your target platform is not Windows 10 or Windows Server 2016+

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, networking, cli
- domain: security, penetration-testing, windows
- platform: windows, cli
- tags: edr-evasion, wfp, red-team, offensive-security, traffic-blocking, c2

## Member repositories
- netero1010/EDRSilencer (main) score 17

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:51.402662+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:12:11.507082+00:00, confidence not recorded.
  - readme: https://github.com/netero1010/EDRSilencer (fetched 2026-08-28T04:05:51.402662+00:00, sha 79f1af32a8be)
- Data as of 2026-08-30T08:39:29.467469+00:00.