What is silentbutdeadly?

SilentButDeadly is a Windows tool that cuts off antivirus and EDR (endpoint detection and response) software from the internet. It's designed for security researchers and red team operators who need to test how security tools behave when they can't communicate with their cloud servers. Rather than killing the security software outright, it quietly blocks their network traffic. The tool works by scanning your running processes for known security products like SentinelOne and Windows Defender. Once it finds them, it uses a built-in Windows feature called the Windows Filtering Platform to create rules that block all incoming and outgoing network connections for those specific programs. It also attempts to stop and disable the associated background services so they can't restart on their own. Everything is temporary by default, when the program exits, the network blocks are removed. The primary users are security professionals conducting authorized penetration tests or analyzing malware in controlled lab environments. For example, a researcher studying how a particular piece of malware behaves might want to temporarily prevent their security software from uploading telemetry or fetching cloud-based threat intelligence, without fully uninstalling the protection. A red team operator might use it to verify whether a security product can be isolated before beginning a simulated attack exercise. A few things stand out about how it's built. It relies entirely on legitimate Windows APIs and doesn't load any custom drivers or touch the kernel, which makes it relatively lightweight. The tradeoff is that it only works on IPv4 connections, and some security products with their own low-level network drivers might not be fully affected. It also requires administrator privileges and only works if Windows Firewall is enabled. The supported target list currently includes SentinelOne and Windows Defender components, but the code is structured so additional products can be added straightforwardly.