Windows: Detect blocked application access enforced by Software Restriction Policies (SRP)

title: "Windows: Detect blocked application access enforced by Software Restriction Policies (SRP)"
id: c5c77e03-9816-4297-92c0-35360329345a
status: test
description: This rule identifies Windows events where application access is denied due to Software Restriction Policies (SRP) configured by an administrator. Restricting execution or access can be abused by attackers to probe allowed paths/publishers or to understand enforcement boundaries during lateral movement and execution attempts. The detection relies on Windows application logs from the Microsoft-Windows-SoftwareRestrictionPolicies provider and matches SRP restriction event IDs 865, 866, 867, 868, and 882.
references:
  - https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml
author: frack113, Huntrule Team
date: 2023-01-12
tags:
  - attack.lateral-movement
  - attack.execution
  - attack.t1072
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Microsoft-Windows-SoftwareRestrictionPolicies
    EventID:
      - 865
      - 866
      - 867
      - 868
      - 882
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b4c8da4a-1c12-46b0-8a2b-0a8521d03442
    type: derived