In the past days we saw that Ransomware Gangs use WDAC to disable EDR products. I have known this type of attack for a year when a guy posts a similar technique on Twitter, but this is the first time that was used in Ransomware Attacks. So, it’s time to explain how it works and how to check it. First, the WDAC is a feature of Microsoft that is very similar to App Locker. We need to download Application Control Wizard from Microsoft webpage. After we install it, we can open it and define the policy. Here we can do two things,