This detection flags Windows Filtering Platform (WFP) filters created by EDRSilencer that block outbound traffic from security tooling processes, thereby impairing endpoint telemetry without needing the tool’s binary to retain its original process name. It targets the WFP filter named "Custom Outbound Filter" and correlates Windows Security events that indicate filter creation or persistence with a Block action. Specifically, it watches EventCode 5447 (runtime filter creation) with ChangeType %%16384 or Add, and EventCode 5441 (persistent filter on BFE startup) when Action indicates Block and FilterName equals "Custom Outbound Filter". The rule extracts destination (dest), user, and process_id, along with detailed filter fields (FilterName, Conditions, FilterType, FilterId, FilterKey, LayerName, LayerId) and derives filter_action and change_type for reporting. The resulting finding notes that a WFP block filter named in the alert was detected on a given destination, signaling potential tampering with telemetry. The analytic story frames this as Defense Evasion: Disabling Security Tools and Security Solution Tampering, with a mapping to MITRE ATT&CK technique T1685. The rule is designed to aid endpoint detections and incident response by surfacing unauthorized WFP filter additions that target outbound telemetry streams.