Hackers Exploit Windows Defender Policies to Shut Down EDR Agents

According to GBHackers On Security, cybercriminals are weaponising Windows Defender Application Control (WDAC) policies to disable Endpoint Detection and Response (EDR) agents en masse. The original proof-of-concept, dubbed “Krueger,” demonstrated embedding a custom WDAC policy that blocks executable files and drivers belonging to major EDR vendors, including CrowdStrike, SentinelOne, Symantec, Tanium, Microsoft Defender for Endpoint, and Velociraptor.

By dropping the policy into the CodeIntegrity folder and triggering a gpupdate, Krueger effectively prevented EDR services and drivers from loading on the target system, and threat actors began deploying Krueger in the wild after the disclosure. A YARA rule identified several new Krueger samples between January and August 2025, including SHA-256 hashes 90937b3a64cc834088a0628fda9ce5bd2855bedfc76b7a63f698784c41da4677 and a795b79f1d821b8ea7b21c7fb95d140512aaef5a186da49b9c68d8a3ed545a89.

Building on this, a new malware family called “DreamDemon” has emerged, written in C++ and embedding a WDAC policy directly in its resources, which writes the policy to C:\\Windows\\System32\\CodeIntegrity\\SiPolicy.p7b, hides and timestomps the file, and may trigger a gpupdate if the system is preconfigured to reference the malicious policy location.

As of September 2025, industry detection remains largely reactive, with Elastic and CrowdStrike releasing rules and Microsoft Defender for Endpoint capable of preventing policy abuse, but no vendor offering a comprehensive preventative control against WDAC-based shutdowns.

Security teams are urged to monitor Windows DeviceGuard registry keys ConfigCIPolicyFilePath and DeployConfigCIPolicy for unexpected policy deployments, alert on new or renamed files in C:\\Windows\\System32\\CodeIntegrity, and validate file magic bytes against extensions to uncover hidden policies.