Detection rules › By eventMicrosoft-Windows-Security-Auditing event 51572 detection rules reference this event. View event page.Sigma (1)Windows Filtering Platform Blocked Connection From EDR Agent Binary severity high T1562 Elastic (1)Potential Evasion via Windows Filtering Platform T1562, T1562.001, T1562.004