Use of Wfc.exe

 1title: Use of Wfc.exe
 2id: 49be8799-7b4d-4fda-ad23-cafbefdebbc5
 3status: test
 4description: The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
 5references:
 6    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wfc/
 7    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
 8author: 'Christopher Peacock @SecurePeacock, SCYTHE @scythe_io'
 9date: 2022-06-01
10tags:
11    - attack.defense-evasion
12    - attack.t1127
13logsource:
14    category: process_creation
15    product: windows
16detection:
17    selection:
18        - Image|endswith: '\wfc.exe'
19        - OriginalFileName: 'wfc.exe'
20    condition: selection
21falsepositives:
22    - Legitimate use by a software developer
23level: medium

References

• Wfc on LOLBAS

  

  Wfc.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases.

  
  Read More

• Applications that can bypass App Control and how to block them

  

  View a list of recommended block rules, based on knowledge shared between Microsoft and the wider security community.

  
  Read More

Related rules

• AspNetCompiler Execution
• C# IL Code Compilation Via Ilasm.EXE
• Detection of PowerShell Execution via Sqlps.exe
• JScript Compiler Execution
• Kavremover Dropped Binary LOLBIN Usage