Bypass Record
Disable or Modify Tools × Microsoft Windows Defender Application Control (WDAC)
A publicly-reported instance of Disable or Modify Tools bypassing Microsoft Windows Defender Application Control (WDAC), recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The vulnerability stems from improper access control (CWE-284) in WDAC policy enforcement. A local attacker can exploit the flaw to execute applications that should be blocked by WDAC, bypassing the application control mechanism entirely. No privileges or user interaction are required.
Detection & mitigation
Monitor Windows Code Integrity operational logs (Event ID 3076/3077) for unexpected policy violations or blocked execution attempts. Investigate anomalous process creation events from normally restricted executables, especially from temporary or user-writable directories. Ensure WDAC policies are properly configured and audit mode is used to detect bypass attempts before enforcement.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.