CME-925
Windows Defender Application Control (WDAC)
Description
Windows application allowlisting framework that enforces code integrity policies at the kernel level. WDAC prevents execution of unauthorized binaries, scripts, and drivers by validating digital signatures, file hashes, or file paths against a deployed policy. Operates in user-mode and kernel-mode, blocking unsigned or untrusted code before it executes. Supports multiple policy modes: Audit (logging only), Enforced (blocking), and Intelligent Security Graph (ISG) integration for cloud-based reputation checks. Successor to AppLocker with kernel-level enforcement.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Unsigned/untrusted binaries blocked at kernel level; requires trusted publisher signature or hash |
| Integrity (I) | H → L | Prevents execution of malicious code; attackers cannot run unsigned payloads |
CWE Relationships
Verification
Verify WDAC policy deployed and enforced
$ Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object -ExpandProperty CodeIntegrityPolicyEnforcementStatus
# Expected: 1 (Enforced) or 2 (Audit)
# Expected: 1 (Enforced) or 2 (Audit)
Platform: windows
$ Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object -ExpandProperty UsermodeCodeIntegrityPolicyEnforcementStatus
# Expected: 1 (Enforced) or 2 (Audit)
# Expected: 1 (Enforced) or 2 (Audit)
Platform: windows
$ Get-ChildItem -Path C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip
# Expected: At least one .cip policy file present
# Expected: At least one .cip policy file present
Platform: windows
$ Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-CodeIntegrity/Operational'; ID=3076} -MaxEvents 10
# Expected: Recent policy load events (ID 3076)
# Expected: Recent policy load events (ID 3076)
Platform: windows