Analytic for WDAC Policy abuse

[netgrain]

Summary of the Pull Request

Adds analytic to hunt for abuse of Windows Defender Application Control (WDAC) policies in order to e.g. silence EDR components. An adversary would likely perform this in privileged mode (not system), which also significantly reduces FP ratio.

See also https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/

Changelog

• new: WDAC Policy File Creation In CodeIntegrity Folder

Example Log Event

(Microsoft Defender XDR)

{
  "ActionType": "FileCreated",
  "FileName": "{1293307f-f66a-498a-bba9-a1dbc31723cf}.CIP",
  "FolderPath": "C:\\Windows\\System32\\CodeIntegrity\\CiPolicies\\Active\\{1293307f-f66a-498a-bba9-a1dbc31723cf}.CIP",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\dllhost.exe",
  "InitiatingProcessCommandLine": "DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}",
  "InitiatingProcessIntegrityLevel": "High",
  "InitiatingProcessTokenElevation": "TokenElevationTypeFull",
  "RequestProtocol": "Local",
}

[nasbench]

@frack113 can you get this field added to the validator so that the CI passes?

[frack113]

Need to change the file name as it is a duplicate.