Custom WDAC Policy Abuse (Interlock)
This rule detects attempts to abuse Windows Defender Application Control (WDAC) policies, specifically looking for the execution of 'RefreshPolicy.exe' or PowerShell commands containing 'Merge-CIPolicy'. This activity is associated with the Interlock threat group, which is known to drop custom WDAC policies to allow their tooling and block EDR components.
Microsoft Sentinel (KQL)
