EDR SILENCERS AND BEYOND: EXPLORING METHODS TO BLOCK EDR COMMUNICATION - PART 1

Summary from the TLDR InfoSec newsletter

This article discusses a novel technique that blocks EDR (Endpoint Detection and Response) communications by manipulating the Windows Name Resolution Policy Table (NRPT) to redirect DNS queries for EDR domains to localhost or invalid IP addresses. The NRPT method can effectively prevent Microsoft Defender for Endpoint from sending data by manipulating DNS resolution, though it requires administrative permissions. The article also covers detection opportunities through PowerShell command execution and registry changes and suggests mitigation strategies for EDR vendors such as monitoring NRPT changes and implementing backup IP addresses for critical FQDNs.