{"id":"401e5d00-b944-11ea-8f9a-00163ecd60ae","title":"AppLocker Prevented Application or Script from Running","description":"Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.\n","author":"Pushkarev Dmitry","status":"test","level":"medium","date":"2020-06-28","modified":"2025-12-03","tags":["attack.execution","attack.t1204.002","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.006","attack.t1059.007"],"technique_ids":["T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1204.002"],"logsource":{"product":"windows","service":"applocker"},"falsepositives":["Unlikely, since this event notifies about blocked application execution. Tune your applocker rules to avoid blocking legitimate applications."],"references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker","https://nxlog.co/documentation/nxlog-user-guide/applocker.html"],"source_path":"rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml","source_sha256":"5e2716f363cb3706e2d3a241fa3f22d842def878526e4c6fd7ab7374859e0f16","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AppLocker Prevented Application or Script from Running\nid: 401e5d00-b944-11ea-8f9a-00163ecd60ae\nstatus: test\ndescription: |\n    Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker\n    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker\n    - https://nxlog.co/documentation/nxlog-user-guide/applocker.html\nauthor: Pushkarev Dmitry\ndate: 2020-06-28\nmodified: 2025-12-03\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.t1059.001\n    - attack.t1059.003\n    - attack.t1059.005\n    - attack.t1059.006\n    - attack.t1059.007\nlogsource:\n    product: windows\n    service: applocker\ndetection:\n    selection:\n        EventID:\n            - 8004 # EXE and DLL\n            - 8007 # MSI and Script\n            - 8022 # Packaged app execution\n            - 8025 # Packaged app deployment\n    condition: selection\nfalsepositives:\n    - Unlikely, since this event notifies about blocked application execution. Tune your applocker rules to avoid blocking legitimate applications.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1059.003","id":"T1059.003","name":"Windows Command Shell","page":"techniques/enterprise/T1059.003/"},{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1059.006","id":"T1059.006","name":"Python","page":"techniques/enterprise/T1059.006/"},{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"}],"data_path":"data/detection-rules/401e5d00-b944-11ea-8f9a-00163ecd60ae.json","kind":"sigma"}