Windows File Events: Suspicious WDAC Policy File Creation in CodeIntegrity Path

title: "Windows File Events: Suspicious WDAC Policy File Creation in CodeIntegrity Path"
id: 19fab3c4-fe8b-4d7b-9e49-c95963c45cda
status: experimental
description: This rule flags file creations where the target path contains \Windows\System32\CodeIntegrity\, indicating a WDAC policy file being written under the Code Integrity policy location. It suppresses common, expected activity from specific management and scripting binaries, and instead highlights potentially abnormal creation attempts that could be used to impair security controls. The detection relies on Windows file event telemetry including the created target filename/path and the creating process image and command-line details.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy
  - https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_wdac_policy_creation.yml
author: X__Junior, Huntrule Team
date: 2025-02-07
modified: 2026-05-18
tags:
  - attack.defense-impairment
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains: \Windows\System32\CodeIntegrity\
  filter_main_images:
    Image|endswith:
      - \Microsoft.ConfigurationManagement.exe
      - \WDAC Wizard.exe
      - C:\Program Files\PowerShell\7-preview\pwsh.exe
      - C:\Program Files\PowerShell\7\pwsh.exe
      - C:\Windows\System32\dllhost.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      - C:\Windows\SysWOW64\dllhost.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  filter_main_cli:
    - CommandLine|contains|all:
        - ConvertFrom-CIPolicy -XmlFilePath
        - "-BinaryFilePath "
    - CommandLine|contains: CiTool --update-policy
    - CommandLine|contains|all:
        - Copy-Item -Path
        - -Destination
  filter_main_system:
    Image: System
  filter_main_wuauclt:
    Image: C:\Windows\System32\wuauclt.exe
  filter_main_wuaucltcore:
    Image:
      - C:\Windows\UUS\arm64\wuaucltcore.exe
      - C:\Windows\UUS\Packages\Preview\arm64\wuaucltcore.exe
  condition: selection_target and not 1 of filter_main_*
falsepositives:
  - Administrators and security vendors could leverage WDAC, apply additional filters as needed.
level: medium
license: DRL-1.1
related:
  - id: 1d2de8a6-4803-4fde-b85b-f58f3aa7a705
    type: derived