Estimated Reading Time: 7 minutesThis post shows a practical bypass of Application Control for Business (formerly Windows Defender Application Control (WDAC)) by abusing NTFS Kernel Extended Attributes (Kernel EAs)
Abusing Extended Attributes to Bypass Application Control For Business
Posted on