Windows AppLocker Blocked Application, Script, MSI, or Packaged App Execution

title: Windows AppLocker Blocked Application, Script, MSI, or Packaged App Execution
id: 1b6054a3-2652-40e7-bd8f-b66967a01a91
status: test
description: This rule flags Windows AppLocker events indicating that an attempted executable, DLL, script, MSI, or packaged application run was blocked. Blocking execution is a key control against attackers attempting to run unauthorized code, including scripts and installers. It relies on AppLocker telemetry from service events matching specific AppLocker EventIDs associated with denied execution and deployment.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
  - https://nxlog.co/documentation/nxlog-user-guide/applocker.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml
author: Pushkarev Dmitry, Huntrule Team
date: 2020-06-28
modified: 2025-12-03
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1059.006
  - attack.t1059.007
logsource:
  product: windows
  service: applocker
detection:
  selection:
    EventID:
      - 8004
      - 8007
      - 8022
      - 8025
  condition: selection
falsepositives:
  - Unlikely, since this event notifies about blocked application execution. Tune your applocker rules to avoid blocking legitimate applications.
level: medium
license: DRL-1.1
related:
  - id: 401e5d00-b944-11ea-8f9a-00163ecd60ae
    type: derived