Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked
Alerts on AppLocker audit-only reports that specific apps would have been blocked if enforcement rules were enabled.
- Product
- windows
- Service
- applocker
- Author
- heyyanu (SigmaHQ), DRL 1.1
- Published
- 2026-03-26
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies AppLocker events where the system reports that an executable, DLL, script, MSI, or packaged app would have been blocked if AppLocker enforcement were enabled. Attackers may try to execute or deploy these application types even when the environment is only auditing, so these warnings can reveal would-be policy violations. The detection relies on Windows AppLocker audit-mode event IDs in the AppLocker service telemetry (EventID 8003, 8006, 8021, 8024).
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
- splunk.comhttps://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked
id: ee40517f-c0ee-494d-834d-310712e1b0ad
status: experimental
description: This rule identifies AppLocker events where the system reports that an executable, DLL, script, MSI, or packaged app would have been blocked if AppLocker enforcement were enabled. Attackers may try to execute or deploy these application types even when the environment is only auditing, so these warnings can reveal would-be policy violations. The detection relies on Windows AppLocker audit-mode event IDs in the AppLocker service telemetry (EventID 8003, 8006, 8021, 8024).
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
- https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml
author: heyyanu, Huntrule Team
date: 2026-03-26
tags:
- attack.execution
- attack.t1204.002
- attack.t1059.001
- attack.t1059.003
- attack.t1059.005
- attack.t1059.006
- attack.t1059.007
logsource:
product: windows
service: applocker
detection:
selection:
EventID:
- 8003
- 8006
- 8021
- 8024
condition: selection
falsepositives:
- Expected during AppLocker policy testing and audit mode deployments
level: medium
license: DRL-1.1
related:
- id: 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
type: derived