PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy

 1title: PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy
 2id: f14b1e99-5e53-4598-98dc-6f20ad7b35e0
 3status: experimental
 4description: |
 5        Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
 6references:
 7    - https://learn.microsoft.com/en-us/powershell/module/applocker/get-applockerpolicy
 8author: Tom3306
 9date: 2026-08-19
10tags:
11    - attack.discovery
12    - attack.t1518.001
13logsource:
14    product: windows
15    category: process_creation
16detection:
17    selection_img:
18        - Image|endswith:
19              - '\powershell.exe'
20              - '\pwsh.exe'
21        - OriginalFileName:
22              - 'PowerShell.EXE'
23              - 'pwsh.dll'
24    selection_cmdlet:
25        CommandLine|contains: 'Get-AppLockerPolicy'
26    selection_flag:
27        CommandLine|contains|windash:
28            - ' -Effective'
29            - ' -Ldap '
30            - ' -Local'
31    condition: all of selection_*
32falsepositives:
33    - PowerShell-based AppLocker auditing and policy troubleshooting by administrators.
34level: low