AppLocker Prevented Application or Script from Running

Title: AppLocker Prevented Application or Script from Running
Status: test
Description:Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
References:
  -https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
  -https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
  -https://nxlog.co/documentation/nxlog-user-guide/applocker.html
Author: Pushkarev Dmitry
Date: 2020-06-28
modified:2025-12-03
Tags:

• -'attack.execution'
• -'attack.t1204.002'
• -'attack.t1059.001'
• -'attack.t1059.003'
• -'attack.t1059.005'
• -'attack.t1059.006'
• -'attack.t1059.007'

Logsource:

• product: windows
• service: applocker

Detection:
  selection:
    EventID:
      -'8004'
      -'8007'
      -'8022'
      -'8025'

  condition:selection
Falsepositives:
  -Unlikely, since this event notifies about blocked application execution. Tune your applocker rules to avoid blocking legitimate applications.
Level: medium