diff --git a/datasets/attack_techniques/T1685/edr_silencer/edrsilencer.yml b/datasets/attack_techniques/T1685/edr_silencer/edrsilencer.yml
new file mode 100644
index 00000000..8b4d7598
--- /dev/null
+++ b/datasets/attack_techniques/T1685/edr_silencer/edrsilencer.yml
@@ -0,0 +1,13 @@
+author: Nasreddine Bencherchali, Splunk
+id: 07335ddc-97c4-44c4-b3af-feabe28a356d
+date: '2026-08-23'
+description: Windows Security event for EDRSilencer creating a Windows Filtering Platform outbound filter.
+environment: attack_range
+directory: edr_silencer
+mitre_technique:
+- T1685
+datasets:
+- name: windows-security-xml
+  path: /datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Security
diff --git a/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log b/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log
new file mode 100644
index 00000000..35ea40f0
--- /dev/null
+++ b/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:e8bb642e285e88378fee955afd4136dda049f8b4c07f7042357a71de571e62cd
+size 2536