Execution of Wfc.exe for AWL Bypass
This rule detects the execution of 'wfc.exe', the Workflow Command-line Compiler. This utility is known to be used for Application Whitelisting (AWL) bypasses and is listed in Microsoft's recommended block rules for applications that can bypass Windows Defender Application Control (WDAC). Detection of this executable could indicate an attempt to bypass security controls or execute unauthorized code.
Sigma
