search

netero1010 / EDRSilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.
MIT License
1.46k stars 185 forks source link

Process name collision for Cisco Secure Endpoint (Formerly Cisco AMP) #3

Closed logdumpster closed 10 months ago

logdumpster commented 10 months ago

The Cisco Secure Endpoint agent runs as sfc.exe, which is also the process name of the windows filesystem checker. I'm not sure if this would cause issues but it would at least cause the program to incorrectly identify the host as running Cisco Secure Endpoint.

Default path: C:\Program Files\Cisco\AMP\X.X.X\sfc.exe (X.X.X denotes the version number)

logdumpster commented 10 months ago

Can either add a second check for the path or just ignore this as it probably doesn't matter that much

netero1010 commented 10 months ago

Thank you for bringing this to my attention. I will initially leave this issue open, as the auto-blocking feature is designed to check only actively running processes. It appears that C:\Windows\System32\sfc.exe is not commonly used as a long-term running process.

However, I do recognize the possibility of a process name collision. Should I receive more reports of similar cases, I will consider updating the code to include the additional checks (e.g., check full path for key words or check if the process is antimalware protected process light).