LoFP / expected during applocker policy testing and audit mode deployments

Techniques

• t1059
• t1059.001
• t1059.003
• t1059.005
• t1059.006
• t1059.007
• t1204
• t1204.002

Sample rules

AppLocker Application Would Have Been Blocked

• source: sigma
• technicques:
  • t1059
  • t1059.001
  • t1059.003
  • t1059.005
  • t1059.006
  • t1059.007
  • t1204
  • t1204.002

Description

Detects when AppLocker “Audit only” enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker “Enforce rules” enforcement mode was enabled.

Detection logic

condition: selection
selection:
  EventID:
  - 8003
  - 8006
  - 8021
  - 8024