Analytic for WDAC Policy abuse

[netgrain]

Summary of the Pull Request

Adds analytic to hunt for abuse of Windows Defender Application Control (WDAC) policies in order to e.g. silence EDR components. An adversary would likely perform this in privileged mode (not system), which also significantly reduces FP ratio.

See also https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/

Changelog

• new: WDAC Policy File Creation In CodeIntegrity Folder

Example Log Event

(Microsoft Defender XDR)

{
  "ActionType": "FileCreated",
  "FileName": "{1293307f-f66a-498a-bba9-a1dbc31723cf}.CIP",
  "FolderPath": "C:\\Windows\\System32\\CodeIntegrity\\CiPolicies\\Active\\{1293307f-f66a-498a-bba9-a1dbc31723cf}.CIP",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\dllhost.exe",
  "InitiatingProcessCommandLine": "DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}",
  "InitiatingProcessIntegrityLevel": "High",
  "InitiatingProcessTokenElevation": "TokenElevationTypeFull",
  "RequestProtocol": "Local",
}