Bypass Record
Exploitation for Priv-Esc × Microsoft Windows Defender Application Control
A publicly-reported instance of Exploitation for Priv-Esc bypassing Microsoft Windows Defender Application Control, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Attackers exploit a vulnerable Electron app (already trusted by WDAC) by using 'argument smuggling' to pass shellcode via manipulated JavaScript function objects. The shellcode executes within the app's process, which has RWX memory for JIT compilation, making it appear normal to EDR. A 'Just-in-time exploit engine' handles offset variations across Windows versions.
Detection & mitigation
Monitor for suspicious child processes or memory operations (e.g., RWX allocations) originating from Electron applications. Enforce strict WDAC policies that limit allowed applications and consider enabling Electron's integrity verification. Use EDR to detect anomalous behavior in trusted processes.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.