Windows Defender Application Control (WDAC): Killing EDR
MITRE ATT&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001
Last updated
Was this helpful?
MITRE ATT&CK™ Impair Defenses: Disable or Modify Tools - Technique T1562.001
Last updated
Was this helpful?
Theory
Windows Defender Application Control (WDAC) was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows clients. It was designed as a security feature under the servicing criteria, defined by the Microsoft Security Response Center (MSRC).
EDR drivers or binaries can therefore be blocked using a WDAC policy.
In order to bypass EDR products using the following method, a reboot is required, which is a bad OPSEC operation.
In order to set up a Windows Defender Application Control (WDAC) policy that can tamper with a targeted EDR, follow this guide:
On a fresh installed Windows Virtual machine, we will install:
The targetted EDR Agent
When all setup, we can start creating an EDR-Blocking WDAC Policy using the WDAC Wizzard utility:
Select "Policy Editor"
Select the "AllowAll" template from C:\Windows\Schemas\CodeIntgrity\ExamplePolicies\AllowAll.xml and click "Next"
Ensure that "Audit Mode" is Unchecked, click "Next"
Click "Add Custom"
Specify conditions on the targeted EDR Publisher, executable/drivers hashes, Product Name, or even Paths.
For this technique to be effective in tampering with EDR functions, it is essential to identify and select both user-land processes (e.g., PE/exe files) and drivers (e.g., sys files) that are necessary for the EDR's to properly work.
However, avoid blocking entire EDR related drivers and processes, as this may lead to system crashes or blue screens. Instead, focus on blocking the minimal components, necessary to interfere with the essential functions of the EDR.
When done, wait for the WDAC Policy to build. It will create an XML and PolicyBinary file.
We can now upload the previously build PolicyBinary file to a target host, and apply it using below command lines:
After reboot, (and maybe several tests to identify which process/driver to block) the EDR should be now disabled.
