Windows AppLocker Audit-Only Events Indicate Would-Be Blocked Executions

title: Windows AppLocker Audit-Only Events Indicate Would-Be Blocked Executions
id: ee40517f-c0ee-494d-834d-310712e1b0ad
status: experimental
description: This rule flags AppLocker events where enforcement is in “Audit only” mode but the event reports that a would-be execution would have been blocked under “Enforce rules.” This matters because attackers often probe with execution attempts that may reveal policy gaps or execute unauthorized binaries if enforcement were enabled. The detection relies on Windows AppLocker logs for specific event IDs covering EXE/DLL, MSI/Script, and packaged app execution/deployment decisions.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
  - https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml
author: heyyanu, Huntrule Team
date: 2026-03-26
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1059.006
  - attack.t1059.007
logsource:
  product: windows
  service: applocker
detection:
  selection:
    EventID:
      - 8003
      - 8006
      - 8021
      - 8024
  condition: selection
falsepositives:
  - Expected during AppLocker policy testing and audit mode deployments
level: medium
license: DRL-1.1
related:
  - id: 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
    type: derived