Execution of VisualUiaVerifyNative.exe for AWL Bypass
This rule detects the execution of 'VisualUiaVerifyNative.exe', a legitimate Microsoft Windows SDK tool. This executable has been identified as a potential method for bypassing Application Whitelisting (AWL) solutions like Windows Defender Application Control (WDAC) and is included in Microsoft's recommended block rules for such bypasses. Adversaries may abuse this signed binary to proxy execution of malicious code, thereby evading defenses.
Sigma
