Use of Wfc.exe (49be8799-7b4d-4fda-ad23-cafbefdebbc5)
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Use of Wfc.exe (49be8799-7b4d-4fda-ad23-cafbefdebbc5) | Sigma-Rules | Trusted Developer Utilities Proxy Execution - T1127 (ff25900d-76d5-449b-a351-8824e62fc81b) | Attack Pattern | 1 |