Sigma rule: AppLocker Application Would Have Been Blocked

Rule

Title

AppLocker Application Would Have Been Blocked

Status

experimental

Level

low

Author

heyyanu

Date

2026-03-26

Modified

2026-10-20

File

rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI,
or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
This rule triggers on the AppLocker audit events and requires review of the reported path against the local AppLocker policy.
Since this rule triggers solely on event IDs without path-based filtering, tuning and false positive
suppression must be handled at the AppLocker policy level by the policy author, not via Sigma filters.
Analysts should review the reported FullFilePath and correlate with the local AppLocker policy to
determine whether the activity is expected or warrants investigation.

Log source

product

windows

service

applocker

Detection

selection:
    EventID:
        - 8003 # EXE and DLL would have been blocked
        - 8006 # MSI and Script would have been blocked
        - 8021 # Packaged app execution would have been blocked
        - 8024 # Packaged app deployment would have been blocked
# Common FP examples (environment-specific, handle at AppLocker policy level):
# filter_main_fp_examples:
#     FullFilePath:
#         - 'C:\Windows\system32\VERSION.dll'
#         - 'C:\Windows\SYSTEM32\WINNSI.DLL'
#         - 'C:\Windows\SYSTEM32\NetSetupEngine.dll'
#         - 'C:\Windows\uus\AMD64\uusbrain.dll'
#         - 'C:\Windows\SYSTEM32\ImplatSetup.dll'
#         - 'C:\Windows\System32\bcrypt.dll'
#         - 'C:\Windows\SYSTEM32\NETAPI32.DLL'
#         - 'C:\Program Files\SplunkUniversalForwarder\bin\VCRUNTIME140.dll'
#     EventID: 8003
condition: selection

False positives (as the rule lists them)

• Expected during AppLocker policy testing and audit mode deployments
• Legitimate system DLLs and applications not yet covered by the AppLocker policy (e.g. Windows system components, third-party software). False positives must be handled at the AppLocker policy level by the policy author, not via Sigma filters.

Tags

• attack.execution
• attack.t1204.002
• attack.t1059.001
• attack.t1059.003
• attack.t1059.005
• attack.t1059.006
• attack.t1059.007

MITRE ATT&CK ids this rule names

• T1059.001
• T1059.003
• T1059.005
• T1059.006
• T1059.007
• T1204.002

References

• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
• https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml