# Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe

DevFeed: [Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe](<https://devfeed.tech/articles/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-exe-fsi-exe-and-fsianycpu-exe-20499.md>)

Original publisher: [Read original article](<https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/>)

Author: bohops

Published: 2020-11-02T00:43:57Z

Content type: article

Language: en

Sources: [Bohops](<https://devfeed.tech/sources/bohops.md>)

Topics: [Windows](<https://devfeed.tech/topics/windows.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>), [SDKs](<https://devfeed.tech/topics/sdks.md>), [Software](<https://devfeed.tech/topics/software.md>), [configuration](<https://devfeed.tech/topics/configuration.md>)

Tags: [configuration](<https://devfeed.tech/tags/configuration.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [sdk](<https://devfeed.tech/tags/sdk.md>), [software](<https://devfeed.tech/tags/software.md>), [software-development](<https://devfeed.tech/tags/software-development.md>), [uncategorized](<https://devfeed.tech/tags/uncategorized.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

This article examines wfc.exe, fsi.exe, and fsianycpu.exe in the context of Microsoft's recommended Windows Defender Application Control block rules. It describes their potential as LOLBIN bypass enablers and discusses testing WDAC policy enforcement without merging the block rules.

## Source excerpt

Introduction In Part One, I blogged about VisualUiaVerifyNative.exe, a LOLBIN that could be used to bypass Windows Defender Application Control (WDAC)/Device Guard. The technique used for circumventing WDAC was originally discovered by Lee Christensen, however, it was not previously disclosed like a handful of others on the Microsoft Recommended Block Rules list. If you are [...]