AppLocker Application Would Have Been Blocked

Title: AppLocker Application Would Have Been Blocked
Status: experimental
Description:Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
References:
  -https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
  -https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
  -https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)
Author: heyyanu
Date: 2026-03-26
modified:None
Tags:

• -'attack.execution'
• -'attack.t1204.002'
• -'attack.t1059.001'
• -'attack.t1059.003'
• -'attack.t1059.005'
• -'attack.t1059.006'
• -'attack.t1059.007'

Logsource:

• product: windows
• service: applocker

Detection:
  selection:
    EventID:
      -'8003'
      -'8006'
      -'8021'
      -'8024'

  condition:selection
Falsepositives:
  -Expected during AppLocker policy testing and audit mode deployments
Level: medium