Windows AppLocker Audit-Only Events Indicating What Would Be Blocked in Enforce Mode
Alerts on AppLocker audit-only reports that specific apps would have been blocked if enforcement rules were enabled.
- Product
- windows
- Service
- applocker
- Author
- heyyanu (SigmaHQ), DRL 1.1
- Published
- 2026-03-26
- Updated
- 2026-10-21
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies AppLocker events that indicate a file or app would have been blocked if AppLocker were set to enforcement mode. It triggers on AppLocker audit-only reporting event IDs covering executable/DLL, script/MSI, and packaged app execution/deployment. This matters because attackers may test which binaries or scripts are permitted; the telemetry provides the reported FullFilePath and the event type to determine whether the activity aligns with the current local AppLocker policy. Review should correlate the event details to the local AppLocker rules since the detection matches only event IDs without path-based filtering.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
- splunk.comhttps://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-10-21
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows AppLocker Audit-Only Events Indicating What Would Be Blocked in Enforce Mode
id: ee40517f-c0ee-494d-834d-310712e1b0ad
status: experimental
description: This rule identifies AppLocker events that indicate a file or app would have been blocked if AppLocker were set to enforcement mode. It triggers on AppLocker audit-only reporting event IDs covering executable/DLL, script/MSI, and packaged app execution/deployment. This matters because attackers may test which binaries or scripts are permitted; the telemetry provides the reported FullFilePath and the event type to determine whether the activity aligns with the current local AppLocker policy. Review should correlate the event details to the local AppLocker rules since the detection matches only event IDs without path-based filtering.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
- https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml
author: heyyanu, Huntrule Team
date: 2026-03-26
modified: 2026-10-20
tags:
- attack.execution
- attack.t1204.002
- attack.t1059.001
- attack.t1059.003
- attack.t1059.005
- attack.t1059.006
- attack.t1059.007
logsource:
product: windows
service: applocker
detection:
selection:
EventID:
- 8003
- 8006
- 8021
- 8024
condition: selection
falsepositives:
- Expected during AppLocker policy testing and audit mode deployments
- Legitimate system DLLs and applications not yet covered by the AppLocker policy (e.g. Windows system components, third-party software). False positives must be handled at the AppLocker policy level by the policy author, not via Sigma filters.
level: low
license: DRL-1.1
related:
- id: 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
type: derived