Block EDR via Custom WDAC Policy

EDR evasion entry for WDAC/App Control policy-based impairment: a prepared policy is staged remotely to prevent selected EDR components from loading when the policy is activated, commonly after a reboot. The steps cover SMBMap staging/reboot and a separate Krueger in-memory variant. File placement alone does not prove policy acceptance or sensor impact; results depend on the target-supported policy format and rules, administrative rights, and activation. The SMBMap variant is Internet-applicable only when the target SMB service is Internet-reachable and authorized credentials can write the administrative share; the Krueger variant assumes an established Beacon context.