Detects Windows Filtering Platform (WFP) filters that are added with a block action to prevent outbound traffic for known EDR/security agent processes. The analytic targets Windows Security Event Log (Event 5447) changes where a WFP filter is created (ChangeType Add) and Block is the Action. It normalizes and parses the hex/escaped Conditions field to identify embedded EDR process names (e.g., MsMpEng.exe, MsSense.exe, and dozens of other security vendor processes). When a match is found, the rule surfaces the destination, user, and the implicated EDR process, along with WFP metadata (FilterName, LayerName, FilterId, etc.). This helps detect attempts to neutralize telemetry or monitoring by manipulating WFP filters, a tactic associated with EDRSilencer-like techniques. The detection culminates in a finding such as Windows Filtering Platform block filter targeting [EDR process] on [dest], and is mapped to threat objects (edr_process as a process_name, FilterName as signature) and MITRE technique T1685 (Defense Evasion: Impair Defenses). It also includes drill-downs and an analytic story around Security Tooling Tampering and EDR evasion. The rule accounts for legitimate WFP/EDR changes as potential false positives and suggests tuning by known ProviderName, LayerName, FilterName, or administrative context. It relies on ingesting Windows Event Log data (EventCode 5447) and relies on the Splunk Windows Add-on to extract EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events.