Wednesday, April 30, 2025
HomeCyber Security NewsNoFilter: Tool that Escalates Privilege Abusing Windows Filtering Platform

NoFilter: Tool that Escalates Privilege Abusing Windows Filtering Platform

Published on

SIEM as a Service

Follow Us on Google News

Privilege escalation is a commonly employed attack vector in the Windows operating system environment.

Attackers often leverage offensive tools such as Meterpreter, CobaltStrike, or Potato tools to execute code such as “NT AUTHORITY\SYSTEM.” 

These tools typically employ token duplication and service manipulation techniques to perform attacks like LSASS tinkering.

- Advertisement - Google News

RPC Mapper and BFE.DLL

The Deep Instinct security research team developed an RPC mapper tool for analyzing RPC methods. The BfeRpcOpenToken method, which is part of the Windows Filtering Platform, captured their attention.

The Windows Filtering Platform is a native platform that offers network traffic control capabilities based on various attributes like application, user, address, and port.

FWPUCLNT.DLL and BFE.DLL play key roles in extracting tokens. By calling FwpsOpenToken0, a handle is duplicated from BfeRpcOpenToken, effectively accessing the BFE service token. 

BfeDriverTokenQuery triggers BfeRpcOpenToken, leading to a device IO request to “WfpAle.” 

This device was created by the tcpip.sys driver becomes instrumental in the token extraction process.

Token query involves calculating a hash based on the LUID, iterating over a hash table, and identifying the appropriate entry. The token insertion function, WfpAleInsertTokenInformationByUserTokenIdIfNeeded, is explored, revealing its relation to IPSec.

Attack Techniques Developed by Researchers

Duplicating Tokens via WFP:

Duplicating tokens (Source: Deep Instinct)

By sending a device IO request, WfpAleProcessTokenReference is invoked, attaching the thread to the process space, duplicating tokens, and adding them to the hash table. Brute-forcing the LUID can lead to token duplication.

Triggering IPSec Connection

Ipsec Communication (Source: Deep Instinct)

Configuring an IPSec policy can lead to token insertion into the hash table. The Print Spooler service is exploited to achieve this through RPC calls.

Manipulating User Service

Gaining the token of another logged-on user can facilitate lateral movement. 

The OneSyncSvc service, involving RPC calls and ALPC ports, is manipulated to achieve this. While these attack techniques are designed to be stealthy, they are not undetectable. 

The “NoFilter” technique highlights a sophisticated and covert approach to privilege escalation by exploiting the Windows Filtering Platform.

Security professionals are advised to stay vigilant, monitor for suspicious activities related to the Windows Filtering Platform, and explore ways to defend against such attacks.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...

Researchers Reveal Threat Actor TTP Patterns and DNS Abuse in Investment Scams

Cybersecurity researchers have uncovered the intricate tactics, techniques, and procedures (TTPs) employed by threat...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...