Wfc.exe

The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).

AWL Bypass

Execute proxied payload with Microsoft signed binary to bypass WDAC policies

wfc.exe {PATH_ABSOLUTE:.xoml}

Execute arbitrary C# code embedded in a XOML file. — MITRE: T1127 — Privileges: User