Sigma rule: Potentially Suspicious WDAC Policy File Creation

Rule

Title

Potentially Suspicious WDAC Policy File Creation

Status

experimental

Level

medium

Author

X__Junior

Date

2025-02-07

Modified

2026-05-18

File

rules/windows/file/file_event/file_event_win_susp_wdac_policy_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could be abused by attacker to block EDR/AV components while allowing their own malicious code to run on the system.

Log source

product

windows

category

file_event

Detection

selection_target:
    # This is a default location but unfortunately it could be any path configured in Group Policy Management Editor.
    # No file extension needed because any extension would work, check first reference.
    TargetFilename|contains: '\Windows\System32\CodeIntegrity\'
filter_main_images:
    Image|endswith:
        - '\Microsoft.ConfigurationManagement.exe' # Replace with full path to avoid false negatives
        - '\WDAC Wizard.exe' # Replace with full path to avoid false negatives
        - 'C:\Program Files\PowerShell\7-preview\pwsh.exe'
        - 'C:\Program Files\PowerShell\7\pwsh.exe'
        - 'C:\Windows\System32\dllhost.exe'
        - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
        - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        - 'C:\Windows\SysWOW64\dllhost.exe'
        - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
        - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
filter_main_cli:
    - CommandLine|contains|all:
          - 'ConvertFrom-CIPolicy -XmlFilePath'
          - '-BinaryFilePath '
    - CommandLine|contains: 'CiTool --update-policy'
    - CommandLine|contains|all:
          - 'Copy-Item -Path'
          - '-Destination'
filter_main_system:
    Image: 'System'
filter_main_wuauclt:
    Image: 'C:\Windows\System32\wuauclt.exe'
filter_main_wuaucltcore:
    Image:
        - 'C:\Windows\UUS\arm64\wuaucltcore.exe'
        - 'C:\Windows\UUS\Packages\Preview\arm64\wuaucltcore.exe'
condition: selection_target and not 1 of filter_main_*

False positives (as the rule lists them)

• Administrators and security vendors could leverage WDAC, apply additional filters as needed.

Tags

• attack.defense-impairment

References

• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy
• https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/
• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide
• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script
• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_wdac_policy_creation.yml