WDAC Policy File Creation In CodeIntegrity Folder
Attackers can craft a custom Windows Defender Application Control (WDAC) policy that blocks Endpoint Detection and Response (EDR) components while allowing their own malicious code. The policy is placed in the privileged Windows Code Integrity folder (C:\Windows\System32\CodeIntegrity\). Upon reboot, the policy prevents EDR drivers from loading, effectively bypassing security measures and may further enable undetected lateral movement within an Active Directory environment.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events for file system activity including creation, modification, and deletion.
Definition
Requirements: By default the file_event log source might not contain the IntegrityLevel of the Process. It should be collected in order to use this rule
detection:
selection:
TargetFilename|contains: ':\Windows\System32\CodeIntegrity\'
TargetFilename|endswith:
- '.cip'
- '.p7b'
IntegrityLevel: 'High'
condition: selectionMay occur legitimately as part of admin activity, but rarely with interactive elevation.
Tactics
Sub-techniques
Other