Potentially Suspicious WDAC Policy File Creation
Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could be abused by an attacker to block EDR/AV components while allowing their own malicious code to run on the system. The rule specifically looks for file creation events in the default WDAC policy directory and filters out known legitimate processes that manage these policies.
Sigma
