Skip to content
Threat Feed
Subscribe

Tag

Wdac

2 briefs RSS
medium advisory

Potentially Suspicious WDAC Policy File Creation

Attackers may create Windows Defender Application Control (WDAC) policy files from abnormal processes to bypass Endpoint Detection and Response (EDR) or Antivirus (AV) solutions while allowing their own malicious code to execute on compromised Windows systems, impacting defense capabilities.

defense-impairment wdac application-control windows
1r 1t
high advisory

WDAC Policy File Creation by Unusual Process

Adversaries may create Windows Defender Application Control (WDAC) policy files using unusual processes to impair defenses and restrict the execution of security products on compromised systems.

Windows Defender Application Control wdac defense-evasion windows
2r 1t