LoFP / legitimate system dlls and applications not yet covered by the applocker policy (e.g. windows system components, third-party software). false positives must be handled at the applocker policy level by the policy author, not via sigma filters.

Techniques

• t1059
• t1059.001
• t1059.003
• t1059.005
• t1059.006
• t1059.007
• t1204
• t1204.002

Sample rules

AppLocker Application Would Have Been Blocked

• source: sigma
• technicques:
  • t1059
  • t1059.001
  • t1059.003
  • t1059.005
  • t1059.006
  • t1059.007
  • t1204
  • t1204.002

Description

Detects when AppLocker “Audit only” enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker “Enforce rules” enforcement mode was enabled. This rule triggers on the AppLocker audit events and requires review of the reported path against the local AppLocker policy. Since this rule triggers solely on event IDs without path-based filtering, tuning and false positive suppression must be handled at the AppLocker policy level by the policy author, not via Sigma filters. Analysts should review the reported FullFilePath and correlate with the local AppLocker policy to determine whether the activity is expected or warrants investigation.

Detection logic

condition: selection
selection:
  EventID:
  - 8003
  - 8006
  - 8021
  - 8024