Query: detection rule: VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended bloc
Matching passage: Sigma rule: VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended bloc. Logsource: windows / process_creation. Rule: title: Use of VisualUiaVerifyNative.exe id: b30a8bc5-e21b-4ca2-9420-0a94019ac56a status: test description: VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/ - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac - https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/ - https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-01 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \VisualUiaVerifyNative.exe - OriginalFileName: VisualUiaVerifyNative.exe condition: selection falsepositives: - Legitimate testing of Microsoft UI parts. level: medium
Near-miss passage: Sigma rule: Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could b. Logsource: windows / file_event. Rule: title: Potentially Suspicious WDAC Policy File Creation id: 1d2de8a6-4803-4fde-b85b-f58f3aa7a705 status: experimental description: 'Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could be abused by attacker to block EDR/AV components while allowing their own malicious code to run on the system. ' references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy - https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/ - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm author: X__Junior date: 2025-02-07 modified: 2026-05-18 tags: - attack.defense-impairment logsource: category: file_event product: windows detection: selection_target: TargetFilename|contains: \Windows\System32\CodeIntegrity\ filter_main_images: Image|endswith: - \Microsoft.ConfigurationManagement.exe - \WDAC Wizard.exe - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\dllhost.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\dllhost.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_cli: - CommandLine|contains|all: - ConvertFrom-CIPolicy -XmlFilePath - '-BinaryFilePath ' - CommandLine|contains: CiTool --update-policy - CommandLine|contains|all: - Copy-Item -Path - -Destination filter_main_system: Image: System filter_main_wuauclt: Image: C:\Windows\System32\wuauclt.exe filter_main_wuaucltcore: Image: - C:\Windows\UUS\arm64\wuaucltcore.exe - C:\Windows\UUS\Packages\Preview\arm64\wuaucltcore.exe condition: selection_target and not 1 of filter_main_* falsepositives: - Administrators and security vendors could leverage WDAC, apply additional filters as needed. level: medium