Disable or Modify Tools × SentinelOne Agent

SilentButDeadly uses WFP dynamic sessions to block network communication of EDR and AV processes, neutralizing their cloud-dependent security functions. It targets processes like SentinelOne.

SilentButDeadly enumerates EDR/AV processes, then creates high-priority bidirectional WFP filters in a dynamic session to block all network traffic for those processes. This severs cloud connectivity, disabling telemetry, threat intelligence updates, and remote commands without terminating processes or using kernel manipulation. Filters are automatically removed when the tool exits, reducing forensic traces.

Monitor for WFP filter additions via Event ID 5157 (Windows Filtering Platform) or ETW providers like Microsoft-Windows-WFP, especially dynamic sessions targeting security product processes. Mitigation: enforce least-privilege to limit admin rights, and use endpoint logging to alert on unexpected WFP rule creation.