Windows Defender Application Control (WDAC)
MITRE ATT&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001
Last updated
MITRE ATT&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001
Last updated
Theory
Windows Defender Application Control (WDAC) was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows clients. It was designed as a security feature under the servicing criteria, defined by the Microsoft Security Response Center (MSRC).
EDR drivers or binaries can therefore be blocked using a WDAC policy.
In order to bypass EDR products using the following method, a reboot is required, which is a bad OPSEC operation.
In order to set up a Windows Defender Application Control (WDAC) policy that can tamper with a targeted EDR, follow this guide:
On a fresh installed Windows Virtual machine, we will install:
The targetted EDR Agent
When all setup, we can start creating an EDR-Blocking WDAC Policy using the WDAC Wizzard utility:
Select "Policy Editor"
Select the "AllowAll" template from C:\Windows\Schemas\CodeIntgrity\ExamplePolicies\AllowAll.xml and click "Next"
Ensure that "Audit Mode" is Unchecked, click "Next"
Click "Add Custom"
Specify conditions on the targeted EDR Publisher, executable/drivers hashes, Product Name, or even Paths.
For this technique to be effective in tampering with EDR functions, it is essential to identify and select both user-land processes (e.g., PE/exe files) and drivers (e.g., sys files) that are necessary for the EDR's to properly work.
However, avoid blocking entire EDR related drivers and processes, as this may lead to system crashes or blue screens. Instead, focus on blocking the minimal components, necessary to interfere with the essential functions of the EDR.
When done, wait for the WDAC Policy to build. It will create an XML and PolicyBinary file.
We can now upload the previously build PolicyBinary file to a target host, and apply it.
Once successful execution, restart the host.
After reboot, (and maybe several tests to identify which process/driver to block) the EDR should be disabled.
