Use of Wfc.exe

calendar Apr 28, 2026 · attack.execution attack.stealth attack.t1127  ·
Share on: linkedin copy

The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.

Sigma rule (View on GitHub)

 1title: Use of Wfc.exe
 2id: 49be8799-7b4d-4fda-ad23-cafbefdebbc5
 3status: test
 4description: The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
 5references:
 6    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wfc/
 7    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
 8author: 'Christopher Peacock @SecurePeacock, SCYTHE @scythe_io'
 9date: 2022-06-01
10tags:
11    - attack.execution
12    - attack.stealth
13    - attack.t1127
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection:
19        - Image|endswith: '\wfc.exe'
20        - OriginalFileName: 'wfc.exe'
21    condition: selection
22falsepositives:
23    - Legitimate use by a software developer
24level: medium

References

Related rules

to-top