WDAC Policy File Creation in CodeIntegrity Folder
This rule detects the creation of Windows Defender Application Control (WDAC) policy files (.cip or .p7b) within the `C:\Windows\System32\CodeIntegrity\` folder by a process running with 'High' integrity. Attackers can leverage this technique to deploy custom WDAC policies that block Endpoint Detection and Response (EDR) components, effectively bypassing security measures and enabling undetected malicious activity after a system reboot.
Sigma
