Hackers Exploit Windows Defender Application Control Policies to Disable EDR Agents

Cyber attackers are abusing Windows Defender Application Control (WDAC) policies to shut down Endpoint Detection and Response (EDR) agents, leaving organizations with serious visibility gaps in their defenses.

What started as a proof-of-concept has now evolved into a real-world threat adopted by advanced groups, including ransomware operators such as Black Basta.

Key Insights

1. WDAC is being weaponized to block EDR from launching at system startup.
2. The original proof-of-concept tool “Krueger” has inspired more advanced malware like “DreamDemon.”
3. Nine months after disclosure, most defenses remain inadequate, exposing enterprises to major risks.

According to researcher Jonathan Beierle, multiple malware families are now using WDAC policies to block EDR processes, effectively turning Microsoft’s own protective mechanism into an attack vector.

How the Attack Works

The method relies on deploying malicious WDAC rules that prevent EDR executables, drivers, and services from loading. By manipulating the file path C:\Windows\System32\CodeIntegrity\SiPolicy.p7b, attackers can apply these policies before EDR tools initialize during system boot.

From Proof-of-Concept to Weaponized Malware

The exploitation trend began with Krueger, a .NET tool that proved WDAC could disable EDR. Released in December 2024, it quickly gained traction among cybercriminals. By 2025, analysts were already finding multiple WDAC-based malware samples across underground repositories.

Captured samples show deliberate targeting of leading EDR solutions, including:

• CrowdStrike Falcon
• SentinelOne
• Microsoft Defender for Endpoint
• Symantec Endpoint Protection
• Tanium

Attackers embed WDAC policies with rules such as:

• %OSDRIVE%\Program Files\CrowdStrike\*
• %SYSTEM32%\drivers\CrowdStrike\*

Rise of DreamDemon Malware

A new family named DreamDemon takes the technique further. Unlike Krueger’s .NET build, DreamDemon is compiled in C++, offering more stealth.

Its tactics include:

• Embedding WDAC policies directly inside executables.
• Deploying them via SMB shares (for example, \\localhost\C$).
• Hiding files and altering timestamps.
• Creating fake log files to avoid suspicion.

<image import – WDAC Policies>

DreamDemon even issues gpupdate /force commands after policy drops, hinting at Group Policy Object (GPO) abuse for persistence. It leverages the Device Guard > Deploy WDAC setting to load policies from alternate paths.

Advanced variants build on Microsoft’s AllowAll.xml template, which allows most applications to run normally while quietly blocking security tools. Some samples specifically target Windows 11 and Server 2025, using wildcard rules unavailable in older versions.

Detection and Defense Gaps

Security teams can spot this activity by monitoring:

• Registry keys such as HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard for suspicious values.
• WDAC policies disguised as other file types.
• API call patterns like FindResourceW, LoadResource, and LockResource.
• YARA rules against embedded WDAC signatures.

Despite awareness, the method remains highly effective, with many EDR vendors yet to roll out meaningful countermeasures. This makes WDAC weaponization a persistent and growing challenge for enterprise defenders.

Indicators of Compromise (IOCs)

Tactics, Techniques, and Procedures (TTPs)