Hackers Leverage Windows Defender Application Control Policies to Disable EDR Agents

Cybercriminals are exploiting Windows Defender Application Control (WDAC) policies to systematically disable Endpoint Detection and Response (EDR) agents, creating a dangerous blind spot in corporate security infrastructure. Real-world threat actors, including ransomware groups like Black Basta, have now adopted a sophisticated attack technique originally developed as a proof-of-concept.  Key Takeaways1. Attackers weaponize WDAC to block […]

The post Hackers Leverage Windows Defender Application Control Policies to Disable EDR Agents appeared first on Cyber Security News.