#NoFilter: Abusing Windows Filtering Platform for Privilege Escalation
Ron Ben Yizhak introduces #NoFilter, a novel privilege escalation technique abusing the Windows Filtering Platform to achieve SYSTEM execution without token manipulation.
Summary
The Limitations of Classic Windows Privilege Escalation
Traditional tools that escalate to NT AUTHORITY\SYSTEM (such as Potato exploits and token stealers) manipulate access tokens and service handles, making them heavily monitored by EDR rules.
Reverse Engineering the Windows Filtering Platform (WFP)
Ron Ben Yizhak explores the built-in Windows Filtering Platform kernel subsystem, examining the Base Filtering Engine (BFE), TCPIP driver interfaces, and IPSec configuration.
Abusing RPC Methods for Undetected Execution
By manipulating undocumented RPC methods exposed by WFP system services, an unprivileged user can coerce kernel components to execute arbitrary processes as SYSTEM.
Evading Modern EDR Detections with #NoFilter
Demonstrating the open-source #NoFilter tool shows how abusing native network filtering components achieves full local privilege escalation while remaining completely invisible to behavioral sensors.
Related talks
Main Stage·43 min
A Hernando · B Martinez
Uncovers overlooked legacy Windows execution paths and registry mechanisms to establish stealthy persistence that evades modern EDR detection.
Main Stage·47 min
Alessandro Magnosi
Malware deployment tactic exploiting NTFS features and emulated read-only filesystems to bypass endpoint inspection.
Main Stage·39 min
Omer Attias · Amit Bar
Discloses a zero-day vulnerability in Windows Defender signature updates, allowing unprivileged users to neutralize EDR protections and run malware fully undetected.