Red Hot Cyber

Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search

Ransomware Gangs weaponize Windows Defender Application Control (WDAC) to disable EDR products.

Alex Necula : 13 January 2025 17:01

In the past days we saw that Ransomware Gangs use WDAC to disable EDR products.

I have known this type of attack for a year when a guy posts a similar technique on Twitter, but this is the first time that was used in Ransomware Attacks.

So, it’s time to explain how it works and how to check it.

Iscriviti GRATIS ai WorkShop Hands-On della RHC Conference 2025 (Giovedì 8 maggio 2025)

Il giorno giovedì 8 maggio 2025 presso il teatro Italia di Roma (a due passi dalla stazione termini e dalla metro B di Piazza Bologna), si terranno i workshop "hands-on", creati per far avvicinare i ragazzi (o persone di qualsiasi età) alla sicurezza informatica e alla tecnologia. Questo anno i workshop saranno:

  • Creare Un Sistema Ai Di Visual Object Tracking (Hands on)
  • Social Engineering 2.0: Alla Scoperta Delle Minacce DeepFake
  • Doxing Con Langflow: Stiamo Costruendo La Fine Della Privacy?
  • Come Hackerare Un Sito WordPress (Hands on)
  • Il Cyberbullismo Tra Virtuale E Reale
  • Come Entrare Nel Dark Web In Sicurezza (Hands on)
    •
    Potete iscrivervi gratuitamente all'evento, che è stato creato per poter ispirare i ragazzi verso la sicurezza informatica e la tecnologia.
    Per ulteriori informazioni, scrivi a [email protected] oppure su Whatsapp al 379 163 8765


    Supporta RHC attraverso:


    Ti piacciono gli articoli di Red Hot Cyber? Non aspettare oltre, iscriviti alla newsletter settimanale per non perdere nessun articolo.

    First, the WDAC is a feature of Microsoft that is very similar to App Locker. We need to download Application Control Wizard from Microsoft webpage.

    After we install it, we can open it and define the policy.

    Select Policy Creator.
    Select Singe Policy Format.
    Select Default Windows Mode
    For all these rules and how they work we can check them on Microsoft sites.

    Here we can do two things, block all External Third parts application and Add a Custom Path that we can launch everything or in our case we can block only a defined publisher. So, remove all default rules and click on Add Custom, select User mode Rule and Rule Action Deny. Click on Publisher on Rule Type and choose the reference file from the disk that has the desired publisher that we want to block. In our case is the PE from an EDR product.

    After that the Wizard produced two files, a .p7b and an .xml file.

    Now we can copy the .p7b file in C:\Windows\System32\CodeIntegrity path.
    We can view if the EDR is currently running.
    After viewing this we reboot the Endpoint so the rule will be applied.

    After the reboot we can see that the EDR services are all in a stopped state. Now we can use Mimikatz or other Tools. This attacks can be used with PSExec, SMBExec for example to copy .p7b file on a remote endpoint and then reboot it. We can do this through GPO too.

    For monitoring this attack we can use rules in EDRs tools, for example when a user copy a .p7b file in CodeIntegrity folder and raise an alert.

    Alex Necula
    Cyber Security Specialist at ACS Data Systems SPA
    Categories
    Banner

    Editorial board : [email protected]

    Facebook Linkedin Youtube Telegram Twitter Pinterest Tumblr
    Redhotcyber is an open-news project that was launched in 2019 and subsequently expanded into a network of individuals collaborating to disseminate information and topics focused on technology, Information Technology, and cybersecurity. Its goal is to increase risk awareness among an ever-growing number of people.