{"id":"b4c8da4a-1c12-46b0-8a2b-0a8521d03442","title":"Restricted Software Access By SRP","description":"Detects restricted access to applications by the Software Restriction Policies (SRP) policy","author":"frack113","status":"test","level":"high","date":"2023-01-12","modified":"","tags":["attack.lateral-movement","attack.execution","attack.t1072"],"technique_ids":["T1072"],"logsource":{"product":"windows","service":"application"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies","https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv"],"source_path":"rules/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml","source_sha256":"fe9eb0fb58baccd1176b89b335b014dabc617899de6c9802dbd84fbe2a5cd900","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Restricted Software Access By SRP\nid: b4c8da4a-1c12-46b0-8a2b-0a8521d03442\nstatus: test\ndescription: Detects restricted access to applications by the Software Restriction Policies (SRP) policy\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies\n    - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv\nauthor: frack113\ndate: 2023-01-12\ntags:\n    - attack.lateral-movement\n    - attack.execution\n    - attack.t1072\nlogsource:\n    product: windows\n    service: application\ndetection:\n    selection:\n        Provider_Name: 'Microsoft-Windows-SoftwareRestrictionPolicies'\n        EventID:\n            - 865 # Access to %1 has been restricted by your Administrator by the default software restriction policy level\n            - 866 # Access to %1 has been restricted by your Administrator by location with policy rule %2 placed on path %3.\n            - 867 # Access to %1 has been restricted by your Administrator by software publisher policy.\n            - 868 # Access to %1 has been restricted by your Administrator by policy rule %2.\n            - 882 # Access to %1 has been restricted by your Administrator by policy rule %2.\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1072","id":"T1072","name":"Software Deployment Tools","page":"techniques/enterprise/T1072/"}],"data_path":"data/detection-rules/b4c8da4a-1c12-46b0-8a2b-0a8521d03442.json","kind":"sigma"}