Blocking EDRs traffic: C-Based Tools That Block EDR Network Traffic via Windows Firewall and WFP

by ddos · December 15, 2025

Blocking EDRs traffic

Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows Filtering Platform (WFP).

Overview

WindowsDefenderFirewall.exe
- Creates inbound and outbound block rules in Windows Defender Firewall for blacklisted EDR processes.
WindowsFilteringPlatform.exe
- Creates WFP filters that block traffic for blacklisted EDR processes. Includes a custom AppID resolution routine to obtain executable identities.
Both tools:
- Verify the process is running with High Integrity and SeDebugPrivilege enabled.
- Enumerate running processes and match them against a blacklist.
- Support a cleanup mode that removes only the rules/filters created by these PoCs.
These tools do not disable or tamper with security products; they create network block rules/filters referencing targeted executables.

How it works (high level)

Privilege checks: Ensures elevated integrity level and SeDebugPrivilege to enumerate processes and configure firewall/WFP.
Process discovery: Enumerates running processes and resolves full image paths for blacklist matching.
Blocking:
- WDF: Adds per-app inbound/outbound block rules via the Windows Firewall COM API.
- WFP: Adds per-app IPv4/IPv6 block filters via the WFP engine.