Techniques
Sample rules
PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy
- source: sigma
- technicques:
- t1518
- t1518.001
Description
Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
Detection logic
condition: all of selection_*
selection_cmdlet:
CommandLine|contains: Get-AppLockerPolicy
selection_flag:
CommandLine|contains|windash:
- ' -Effective'
- ' -Ldap '
- ' -Local'
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll