By "replaced" I did not mean worse. Both SAC and your setup "WDAC + ISG" cover slightly different attack surfaces.
"WDAC + ISG" is vulnerable to some popular attack vectors that SAC covers. These attack vectors have become more dangerous since the year 2023 due to some improvements in transferring MOTW from disk images (ISO, IMG, VHD, VHDX) to their content. Similar improvements will be applied soon to archives (7-Zip, Gz, and RAR). As we know, ISG and SmartScreen are vulnerable to the attack vector via benign/vulnerable EXE + malicious DLL, when the EXE has got MOTW. It is a very simplistic attack when EXE + DLL is contained in the disk image or archive.
SAC can be "bypassed" by some signed malware samples, that can be blocked by "WDAC + ISG".
WDAC without ISG is more comprehensive than SAC and "WDAC + ISG". So yes, Microsoft advises Administrators to use WDAC over SAC. Another reason is that SAC cannot use Managed Installer which automatically allows applications installed by a designated software distribution solution, such as Microsoft Configuration Manager (MEMCM) or Microsoft Intune. WDAC does have several convenient features for Administrators - SAC does not.
Both SAC and "WDAC + ISG" cannot be strong protection against targeted attacks and lateral movement, but can be good protection at home and small business.
The setup "WDAC + ISG" can be improved by blocking execution in folders where users download files from the Internet, and by blocking execution from removable drives.
Pentest and adversary emulation tool Brute Ratel C4 is effective at defeating modern detection capabilities – and malicious actors have begun to adopt it.
Figure 6. Viewing ISO image with “show hidden files” enabled.
In the most popular version, the attackers use shortcuts to run the benign/reputable EXE file. It is easy to change the shortcut icon, so it looks like a document, media file, etc. The intention of such an attack is not to bypass ISG (it is a side effect), but to bypass SmartScreen and fool AVs.
SAC can block such attacks in 2 ways:
Before the year 2023, the malicious DLL could be blocked (if it was unsigned).
Since the year 2023, the shortcut can be blocked (if the disk image was downloaded from the Internet).
Unfortunately, the MOTW improvements from the year 2023 work to the advantage of SAC but are not good for WDAC ISG.
Similar attacks can be performed via flash drives. It is also possible to use archives via CVE-2023-40477 vulnerability if the archiver applications are not updated.
Rofl SAC blocked starfield for me. Any takers: How many hundred thousands of this game has been sold ? My outlook account will consist of only fp reports for SAC till I get to annoyed and disable it View attachment 278764
Of course Smart *Irony tag of* AC blocked the whole exe and the game is not usable. MS allows people to be guinea pigs for their insider build why not offer them a button to test a exe? Funfact: Bethesda (the starfield company) was acquired by Microsoft. Either the reported fp from yesterday will result in solving the problem or I have to get rid of it sooner than thought.
I disabled SAC.
Support wrote back they say it's not SAC on there part. Maybe I can file it again under another category they say. After some try and error (DISM repair and such) I gave up. Not in the mood to find out what the problem is when support say it's not SAC when my pc says SAC blocked...