Sigma rule: WDAC Policy File Creation In CodeIntegrity Folder

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-4e35f7b99cb3, updated 2025-01-30T00:00:00.000Z.

Rule

Title: WDAC Policy File Creation In CodeIntegrity Folder
Status: experimental
Level: medium
Author: Andreas Braathen (mnemonic.io)
Date: 2025-01-30
File: rules-threat-hunting/windows/file/file_event/file_event_win_wdac_policy_creation_in_codeintegrity_folder.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Attackers can craft a custom Windows Defender Application Control (WDAC) policy that blocks Endpoint Detection and Response (EDR) components while allowing their own malicious code. The policy is placed in the privileged Windows Code Integrity folder (C:\Windows\System32\CodeIntegrity\). Upon reboot, the policy prevents EDR drivers from loading, effectively bypassing security measures and may further enable undetected lateral movement within an Active Directory environment.

Log source

product: windows
category: file_event
definition: Requirements: By default the file_event log source might not contain the IntegrityLevel of the Process. It should be collected in order to use this rule

Detection

selection:
    TargetFilename|contains: ':\Windows\System32\CodeIntegrity\'
    TargetFilename|endswith:
        - '.cip'
        - '.p7b'
    IntegrityLevel: 'High'
condition: selection

False positives (as the rule lists them)

May occur legitimately as part of admin activity, but rarely with interactive elevation.

MITRE ATT&CK ids this rule names

T1685

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/file/file_event/file_event_win_wdac_policy_creation_in_codeintegrity_folder.yml

Sources and licences

SigmaHQ
"WDAC Policy File Creation In CodeIntegrity Folder" by Andreas Braathen (mnemonic.io) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/file/file_event/file_event_win_wdac_policy_creation_in_codeintegrity_folder.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: WDAC Policy File Creation In CodeIntegrity Folder",
entity page, dataset version ref-4e35f7b99cb3, updated 2025-01-30T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/121b25f7-b9d6-4b37-afa0-cba317ec52f3 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 121b25f7-b9d6-4b37-afa0-cba317ec52f3, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.