LoFP LoFP / need tuning applocker or add exceptions in siem

Techniques

Sample rules

File Was Not Allowed To Run

Description

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

Detection logic

condition: selection
selection:
  EventID:
  - 8004
  - 8007
  - 8022
  - 8025