Disable or Modify Tools × CrowdStrike Falcon

WDAC policies are being used by threat actors to block endpoint detection and response (EDR) agents... The technique remains effective against many EDR products

Attackers deploy a WDAC policy (as a .cip file) that contains block rules targeting EDR executables, drivers, or file paths. The policy is applied via WMI or direct file placement, then the system is rebooted to enforce it. WDAC blocks the specified EDR binaries from executing, effectively disabling the security agent. Rules can use file path, file name, file description, or file signature attributes. Kernel-mode drivers cannot be blocked by file path rules, but user-mode components and some drivers can be stopped.

Monitor for creation or modification of WDAC policy files (*.cip) in %SystemRoot%\System32\CodeIntegrity\ and policy activation events (e.g., WMI activity, Event ID 3099). Mitigation: enforce WDAC policies via a secure, centrally managed process and restrict local policy modification to authorized administrators only.