The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
- C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\wfc.exe
Execute arbitrary C# code embedded in a XOML file.
Usecase: Execute proxied payload with Microsoft signed binary to bypass WDAC policies
Privileges required: User
OS: Windows 10 2004 (likely previous and newer versions as well)
MITRE ATT&CK®: T1127