Restricted Software Access By SRP

Title: Restricted Software Access By SRP
Status: test
Description:Detects restricted access to applications by the Software Restriction Policies (SRP) policy
References:
  -https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies
  -https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
Author: frack113
Date: 2023-01-12
modified:None
Tags:

• -'attack.lateral-movement'
• -'attack.execution'
• -'attack.t1072'

Logsource:

• product: windows
• service: application

Detection:
  selection:
    Provider_Name: 'Microsoft-Windows-SoftwareRestrictionPolicies'
    EventID:
      -'865'
      -'866'
      -'867'
      -'868'
      -'882'

  condition:selection
Falsepositives:
  -Unknown
Level: high