BlockEDRTraffic – EDR Evasive Lateral Movement Tool

BlockEDRTraffic is a pair of Windows proof-of-concept tools described as EDR evasive lateral movement utilities that prevent Endpoint Detection and Response (EDR) agents from sending network telemetry. It offers two evasion paths: creating inbound and outbound block rules with Windows Defender Firewall, or establishing per-application IPv4 and IPv6 filters via Windows Filtering Platform.

The tools verify elevated integrity and SeDebugPrivilege before acting, identify blacklisted EDR processes, and apply network blocks only to those targets, while including a scoped cleanup mode that removes the rules they created. Crucially, the article notes the tools do not disable or tamper with security products and that defenders typically focus on event logs or kernel hooks, whereas BlockEDRTraffic targets the network telemetry blind spot.

An attack scenario described for red teams depicts gaining access via phishing, then suppressing EDR network calls to run enumeration and lateral movement tools during a brief stealth window. The piece also lists Defender Antivirus, Defender for Endpoint, and Elastic EDR as supported targets and highlights that the EDR process list is embedded in the source to enable easy updates. 5 September 2025