Sigma rule: Restricted Software Access By SRP

Rule

Title

Restricted Software Access By SRP

Status

test

Level

high

Author

frack113

Date

2023-01-12

File

rules/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects restricted access to applications by the Software Restriction Policies (SRP) policy

Log source

product

windows

service

application

Detection

selection:
    Provider_Name: 'Microsoft-Windows-SoftwareRestrictionPolicies'
    EventID:
        - 865 # Access to %1 has been restricted by your Administrator by the default software restriction policy level
        - 866 # Access to %1 has been restricted by your Administrator by location with policy rule %2 placed on path %3.
        - 867 # Access to %1 has been restricted by your Administrator by software publisher policy.
        - 868 # Access to %1 has been restricted by your Administrator by policy rule %2.
        - 882 # Access to %1 has been restricted by your Administrator by policy rule %2.
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.lateral-movement
• attack.execution
• attack.t1072

MITRE ATT&CK ids this rule names

• T1072

References

• https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies
• https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml