Windows AppLocker Audit-Only Events Indicating What Would Be Blocked in Enforce Mode

title: Windows AppLocker Audit-Only Events Indicating What Would Be Blocked in Enforce Mode
id: ee40517f-c0ee-494d-834d-310712e1b0ad
status: experimental
description: This rule identifies AppLocker events that indicate a file or app would have been blocked if AppLocker were set to enforcement mode. It triggers on AppLocker audit-only reporting event IDs covering executable/DLL, script/MSI, and packaged app execution/deployment. This matters because attackers may test which binaries or scripts are permitted; the telemetry provides the reported FullFilePath and the event type to determine whether the activity aligns with the current local AppLocker policy. Review should correlate the event details to the local AppLocker rules since the detection matches only event IDs without path-based filtering.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
  - https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml
author: heyyanu, Huntrule Team
date: 2026-03-26
modified: 2026-10-20
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1059.006
  - attack.t1059.007
logsource:
  product: windows
  service: applocker
detection:
  selection:
    EventID:
      - 8003
      - 8006
      - 8021
      - 8024
  condition: selection
falsepositives:
  - Expected during AppLocker policy testing and audit mode deployments
  - Legitimate system DLLs and applications not yet covered by the AppLocker policy (e.g. Windows system components, third-party software). False positives must be handled at the AppLocker policy level by the policy author, not via Sigma filters.
level: low
license: DRL-1.1
related:
  - id: 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
    type: derived