LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Wfc.exe

View source

The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).

AWL Bypass
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

AWL Bypass1

EXAMPLE 01T1127

Execute arbitrary C# code embedded in a XOML file.

COMMAND
wfc.exe {PATH_ABSOLUTE:.xoml}
USE CASE
Execute proxied payload with Microsoft signed binary to bypass WDAC policies
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 2004 (likely previous and newer versions as well)
Execute · XOML
02 / ON DISK

Known paths

C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\wfc.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    As a Windows SDK binary, execution on a system may be suspicious

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Matt Graeber@mattifestation
Jimmy@bohops