Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution
Alerts on AppLocker event IDs showing blocked execution of apps, scripts, DLLs, MSI, or packaged apps.
- Product
- windows
- Service
- applocker
- Author
- Pushkarev Dmitry (SigmaHQ), DRL 1.1
- Published
- 2020-06-28
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows AppLocker events where execution is prevented for an application, DLL, script, MSI, or packaged app. Blocking execution is a key control that can stop attempted payload execution, but attackers may probe or retry blocked paths. The detection relies on AppLocker telemetry from events matching the configured AppLocker EventIDs (8004, 8007, 8022, 8025).
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
- nxlog.cohttps://nxlog.co/documentation/nxlog-user-guide/applocker.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution
id: 1b6054a3-2652-40e7-bd8f-b66967a01a91
status: test
description: This rule flags Windows AppLocker events where execution is prevented for an application, DLL, script, MSI, or packaged app. Blocking execution is a key control that can stop attempted payload execution, but attackers may probe or retry blocked paths. The detection relies on AppLocker telemetry from events matching the configured AppLocker EventIDs (8004, 8007, 8022, 8025).
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
- https://nxlog.co/documentation/nxlog-user-guide/applocker.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml
author: Pushkarev Dmitry, Huntrule Team
date: 2020-06-28
modified: 2025-12-03
tags:
- attack.execution
- attack.t1204.002
- attack.t1059.001
- attack.t1059.003
- attack.t1059.005
- attack.t1059.006
- attack.t1059.007
logsource:
product: windows
service: applocker
detection:
selection:
EventID:
- 8004
- 8007
- 8022
- 8025
condition: selection
falsepositives:
- Unlikely, since this event notifies about blocked application execution. Tune your applocker rules to avoid blocking legitimate applications.
level: medium
license: DRL-1.1
related:
- id: 401e5d00-b944-11ea-8f9a-00163ecd60ae
type: derived