AppLocker Application Would Have Been Blocked

 1title: AppLocker Application Would Have Been Blocked
 2id: 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
 3status: experimental
 4description: |
 5    Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI,
 6    or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
 7    This rule triggers on the AppLocker audit events and requires review of the reported path against the local AppLocker policy.
 8    Since this rule triggers solely on event IDs without path-based filtering, tuning and false positive
 9    suppression must be handled at the AppLocker policy level by the policy author, not via Sigma filters.
10    Analysts should review the reported FullFilePath and correlate with the local AppLocker policy to
11    determine whether the activity is expected or warrants investigation.    
12references:
13    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
14    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
15    - https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html
16    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)
17author: heyyanu
18date: 2026-03-26
19modified: 2026-10-20
20tags:
21    - attack.execution
22    - attack.t1204.002
23    - attack.t1059.001
24    - attack.t1059.003
25    - attack.t1059.005
26    - attack.t1059.006
27    - attack.t1059.007
28logsource:
29    product: windows
30    service: applocker
31detection:
32    selection:
33        EventID:
34            - 8003 # EXE and DLL would have been blocked
35            - 8006 # MSI and Script would have been blocked
36            - 8021 # Packaged app execution would have been blocked
37            - 8024 # Packaged app deployment would have been blocked
38    # Common FP examples (environment-specific, handle at AppLocker policy level):
39    # filter_main_fp_examples:
40    #     FullFilePath:
41    #         - 'C:\Windows\system32\VERSION.dll'
42    #         - 'C:\Windows\SYSTEM32\WINNSI.DLL'
43    #         - 'C:\Windows\SYSTEM32\NetSetupEngine.dll'
44    #         - 'C:\Windows\uus\AMD64\uusbrain.dll'
45    #         - 'C:\Windows\SYSTEM32\ImplatSetup.dll'
46    #         - 'C:\Windows\System32\bcrypt.dll'
47    #         - 'C:\Windows\SYSTEM32\NETAPI32.DLL'
48    #         - 'C:\Program Files\SplunkUniversalForwarder\bin\VCRUNTIME140.dll'
49    #     EventID: 8003
50    condition: selection
51falsepositives:
52    - Expected during AppLocker policy testing and audit mode deployments
53    - Legitimate system DLLs and applications not yet covered by the AppLocker policy (e.g. Windows system components, third-party software). False positives must be handled at the AppLocker policy level by the policy author, not via Sigma filters.
54level: low # Increase to medium or high based on the criticality of the applications being monitored and false positive tolerance.