Sigma rule: AppLocker Prevented Application or Script from Running

Rule

Title

AppLocker Prevented Application or Script from Running

Status

test

Level

medium

Author

Pushkarev Dmitry

Date

2020-06-28

Modified

2025-12-03

File

rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Log source

product

windows

service

applocker

Detection

selection:
    EventID:
        - 8004 # EXE and DLL
        - 8007 # MSI and Script
        - 8022 # Packaged app execution
        - 8025 # Packaged app deployment
condition: selection

False positives (as the rule lists them)

• Unlikely, since this event notifies about blocked application execution. Tune your applocker rules to avoid blocking legitimate applications.

Tags

• attack.execution
• attack.t1204.002
• attack.t1059.001
• attack.t1059.003
• attack.t1059.005
• attack.t1059.006
• attack.t1059.007

MITRE ATT&CK ids this rule names

• T1059.001
• T1059.003
• T1059.005
• T1059.006
• T1059.007
• T1204.002

References

• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
• https://nxlog.co/documentation/nxlog-user-guide/applocker.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml