CVE-2020-0951: Microsoft PowerShell WDAC Bypass Vulnerability

CVE-2020-0951 Overview

A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) that allows attackers to circumvent WDAC enforcement policies. This vulnerability enables the execution of PowerShell commands that would otherwise be blocked by WDAC protection mechanisms, potentially allowing arbitrary code execution on affected systems.

An attacker who successfully exploits this vulnerability could execute PowerShell commands that would normally be restricted by WDAC policies. To exploit the vulnerability, an attacker requires administrator access on a local machine where PowerShell is running. The attacker could then connect to a PowerShell session and send commands to execute arbitrary code, effectively bypassing the security controls designed to prevent unauthorized code execution.

Critical Impact

Successful exploitation allows attackers with administrator access to bypass Windows Defender Application Control and execute arbitrary PowerShell commands, undermining application whitelisting controls designed to prevent malicious code execution.

Affected Products

• Microsoft PowerShell (multiple versions including 7.0.8)
• Microsoft Windows 10 (versions 1607, 1709, 1803, 1809, 1903, 1909, 2004)
• Microsoft Windows Server 2016 (including versions 1903, 1909, 2004)
• Microsoft Windows Server 2019

Discovery Timeline

• September 11, 2020 - CVE-2020-0951 published to NVD
• February 23, 2026 - Last updated in NVD database

Technical Details for CVE-2020-0951

Vulnerability Analysis

This vulnerability represents a security feature bypass in Windows Defender Application Control (WDAC), a critical Windows security component designed to restrict which applications and scripts can run on a system. WDAC is commonly deployed in enterprise environments to enforce application whitelisting policies and prevent the execution of unauthorized code.

The flaw exists in how PowerShell commands are validated when WDAC protection is enabled. Under normal circumstances, WDAC should block the execution of unauthorized scripts and commands. However, due to improper validation logic, an attacker with local administrator privileges can craft commands that evade WDAC's enforcement mechanisms.

The attack requires local access and high privileges (administrator), which somewhat limits the attack surface. However, in environments where WDAC is relied upon as a primary defense-in-depth mechanism, this bypass can have significant security implications. Organizations using WDAC to maintain compliance with security policies or to protect against insider threats are particularly affected.

Root Cause

The root cause of this vulnerability lies in the improper validation of PowerShell commands when WDAC protection is active. The PowerShell command validation logic failed to properly enforce WDAC policies under certain conditions, allowing specially crafted commands to bypass the application control checks.

Microsoft addressed this issue by correcting how PowerShell commands are validated when WDAC protection is enabled, ensuring that all PowerShell execution paths properly respect WDAC enforcement policies.

Attack Vector

The attack vector is local, requiring an attacker to have administrator access on the target machine. The exploitation flow involves:

1. The attacker gains local administrator access to a Windows system with WDAC enabled
2. The attacker connects to a PowerShell session on the local machine
3. Using specially crafted commands, the attacker bypasses WDAC validation
4. The attacker executes PowerShell commands that should normally be blocked by WDAC policies

This bypass is particularly concerning in environments where WDAC is used as a key component of a defense-in-depth strategy, as it allows an attacker with elevated privileges to undermine application whitelisting controls. For detailed technical information, refer to the Microsoft Security Advisory.

Detection Methods for CVE-2020-0951

Indicators of Compromise

• Unusual PowerShell activity from administrator accounts, particularly commands that should be blocked by WDAC policies
• PowerShell command-line arguments or script execution patterns that deviate from established baselines
• WDAC policy violation events in Windows Event logs that don't result in blocked execution
• Evidence of PowerShell remoting sessions (Enter-PSSession, Invoke-Command) on systems where such activity is unexpected

Detection Strategies

• Monitor Windows Event Log for WDAC/AppLocker events (Event IDs 8002, 8003, 8004, 8005, 8006, 8007) that indicate policy bypass attempts
• Implement PowerShell ScriptBlock logging and Module logging to capture detailed command execution records
• Deploy behavioral detection rules that identify administrator accounts executing unusual PowerShell commands
• Use SentinelOne's behavioral AI to detect anomalous PowerShell execution patterns that may indicate WDAC bypass attempts

Monitoring Recommendations

• Enable PowerShell Transcription logging to capture full command history and output
• Configure enhanced WDAC audit mode policies to detect potential bypass attempts before they succeed
• Implement centralized log collection for PowerShell and WDAC events across all endpoints
• Establish baseline PowerShell usage patterns for administrator accounts to identify anomalous activity

How to Mitigate CVE-2020-0951

Immediate Actions Required

• Apply the security update from Microsoft for all affected Windows and PowerShell versions immediately
• Review administrator account access and ensure principle of least privilege is enforced
• Audit systems for signs of WDAC bypass attempts using the detection strategies outlined above
• Consider implementing additional application control mechanisms as defense-in-depth

Patch Information

Microsoft has released security updates to address this vulnerability. The update corrects how PowerShell commands are validated when WDAC protection is enabled. Organizations should apply patches for all affected products including Windows 10 (versions 1607 through 2004), Windows Server 2016, Windows Server 2019, and PowerShell.

For detailed patch information and download links, refer to the Microsoft Security Advisory for CVE-2020-0951.

Workarounds

• Implement Constrained Language Mode for PowerShell to limit available cmdlets and language features
• Restrict PowerShell remoting access to only essential administrator accounts
• Deploy additional endpoint detection and response (EDR) solutions like SentinelOne to detect WDAC bypass attempts
• Consider implementing Just-In-Time (JIT) administrator access to limit the window of exposure for privileged accounts

# Verify WDAC policy status and enable enhanced logging
# Check current WDAC policy status
Get-CimInstance -Namespace root/Microsoft/Windows/CI -ClassName MSFT_MpComputerStatus

# Enable PowerShell ScriptBlock logging via Group Policy or registry
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1

# Enable Module logging for detailed PowerShell activity tracking
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -Value 1