Microsoft-Windows-AppLocker

Event	Title	Channel	Sample	Rule
8000	AppID policy conversion failed.	EXE and DLL	N	N
8001	The AppLocker policy was applied successfully to this computer.	EXE and DLL	Y	N
8002	FilePathBuffer was allowed to run.	EXE and DLL	Y	Y
8003	RuleAndFileData.FilePath was allowed to run but would have been prevented from …	EXE and DLL	Y	Y
8004	FilePathBuffer was prevented from running.	EXE and DLL	Y	Y
8005	FilePathBuffer was allowed to run.	MSI and Script	Y	Y
8006	FilePathBuffer was allowed to run but would have been prevented from running if …	MSI and Script	Y	Y
8007	FilePathBuffer was prevented from running.	MSI and Script	Y	Y
8008	FilePathBuffer: AppLocker component not available on this SKU.	EXE and DLL	N	N
8009	FilePathBuffer: AppLocker component not available on this SKU.	MSI and Script	N	N
8010	SrpPolicyConversionStart	Operational	N	N
8011	SrpPolicyConversionStop	Operational	N	N
8012	SrpPolicyConversionStop8012	Operational	N	N
8013	SrpPolicyRuleSortStart	Operational	N	N
8014	SrpPolicyRuleSortStop	Operational	N	N
8015	SrpPolicyHitCountJoinStart	Operational	N	N
8016	SrpPolicyHitCountJoinStop	Operational	N	N
8017	SrpPolicyLoad	Operational	Y	N
8018	SrpPolicyLoad	Operational	Y	N
8019	SrpPolicyLoadStop8019	Operational	N	N
8020	PackageBuffer was allowed to run.	Packaged app-Execution	Y	N
8021	PackageBuffer was allowed to run but would have been prevented from running if …	Packaged app-Execution	Y	Y
8022	PackageBuffer was prevented from running.	Packaged app-Execution	N	Y
8023	PackageBuffer was allowed to be installed.	Packaged app-Deployment	Y	N
8024	PackageBuffer was allowed to run but would have been prevented from running if …	Packaged app-Deployment	Y	Y
8025	PackageBuffer was prevented from running.	Packaged app-Deployment	Y	Y
8026	No packaged apps can be executed while Exe rules are being enforced and no …	Packaged app-Deployment	N	N
8027	No packaged apps can be executed while Exe rules are being enforced and no …	Packaged app-Execution	N	N
8028	FilePath was allowed to run but would have been prevented if the Config CI …	MSI and Script	Y	N
8029	FilePath was prevented from running due to Config CI policy.	MSI and Script	Y	Y
8030	ManagedInstaller check SUCCEEDED during Appid verification of ImageNameLength.	EXE and DLL	N	N
8031	SmartlockerFilter detected file FileName being written by process …	EXE and DLL	N	N
8032	ManagedInstaller check FAILED during Appid verification of ImageNameLength.	EXE and DLL	N	N
8033	ManagedInstaller check FAILED during Appid verification of ImageNameLength.	EXE and DLL	N	N
8034	ManagedInstaller Script check FAILED during Appid verification of …	MSI and Script	N	N
8035	ManagedInstaller Script check SUCCEEDED during Appid verification of …	MSI and Script	N	N
8036	CLSID was prevented from running due to Config CI policy.	MSI and Script	N	N
8037	FilePath passed Config CI policy and was allowed to run.	MSI and Script	Y	N
8038	Publisher info.	MSI and Script	Y	N
8039	Package family name Version version GUID was allowed to install or update but …	MSI and Script	N	N
8040	Package family name Version version GUID was prevented from installing or …	MSI and Script	N	Y
8041	A Subject was allowed to ExecutionDecision by system execution policy.	MSI and Script	N	N
8042	A Subject was not allowed to be executed by system execution policy.	MSI and Script	N	N
8043	Process RegisterUninstallStringEventData.ProcessName attempted to register …	EXE and DLL	Y	N
8044	Checking cmdline UninstallStringLength against registered UninstallStrings …	EXE and DLL	N	N
8045	Smart App Control Block Details	MSI and Script	N	N
8045	Event ID 8045	Operational	N	N
9000	The application setting with ID 'AppID' and name 'SettingName' was queried.	Verbose	N	N
9001	The application setting with ID 'AppID' and name 'SettingName' was queried, and …	Verbose	N	N

Event ID 8000: AppID policy conversion failed.

Channel: EXE and DLL
Collection Priority: Recommended (ASD, others)

Description

AppID policy conversion failed. Status Status.

Message #

AppID policy conversion failed. Status %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 8001: The AppLocker policy was applied successfully to this computer.

Channel: EXE and DLL
Level: Informational
Collection Priority: Recommended (ASD, others)

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "event_source_name": "",
    "event_id": 8001,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T23:50:01.740733+00:00",
    "event_record_id": 39,
    "correlation": {},
    "execution": {
      "process_id": 4372,
      "thread_id": 9624
    },
    "channel": "Microsoft-Windows-AppLocker/EXE and DLL",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 8002: FilePathBuffer was allowed to run.

Channel: EXE and DLL
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (NSA, others)

Message #

%11 was allowed to run.

Fields #

Name	Description
`RuleAndFileData.PolicyNameLength` UInt16
`RuleAndFileData.PolicyName`
`RuleAndFileData.RuleId` GUID
`RuleAndFileData.RuleNameLength` UInt16
`RuleAndFileData.RuleName`
`RuleAndFileData.RuleSddlLength` UInt16
`RuleAndFileData.RuleSddl`
`RuleAndFileData.TargetUser` SID
`RuleAndFileData.TargetProcessId` UInt32	Process ID of the target process.
`RuleAndFileData.FilePathLength` UInt16
`RuleAndFileData.FilePath`
`RuleAndFileData.FileHashLength` UInt16
`RuleAndFileData.FileHash` Binary
`RuleAndFileData.FqbnLength` UInt16
`RuleAndFileData.Fqbn` UnicodeString
`RuleAndFileData.TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`RuleAndFileData.FullFilePathLength` UInt16
`RuleAndFileData.FullFilePath`
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString
`FileHashLength` UInt16
`FileHash` Binary
`FqbnLength` UInt16
`Fqbn` UnicodeString
`TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`FullFilePathLength` UInt16
`FullFilePathBuffer` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8002,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T14:14:52.3346755+00:00",
    "event_record_id": 1186891,
    "correlation": {},
    "execution": {
      "process_id": 7916,
      "thread_id": 7244
    },
    "channel": "Microsoft-Windows-AppLocker/EXE and DLL",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "RuleAndFileData": {
      "PolicyNameLength": "3",
      "PolicyName": "EXE",
      "RuleId": "{aa000001-0000-0000-0000-00000000a001}",
      "RuleNameLength": "20",
      "RuleName": "ALTest-Allow-Windows",
      "RuleSddlLength": "57",
      "RuleSddl": "D:(XA;;FX;;;S-1-1-0;(APPID://PATH Contains \"%WINDIR%\\*\"))",
      "TargetUser": "S-1-5-21-1006758700-2167138679-1475694448-1105",
      "TargetProcessId": "4424",
      "FilePathLength": "22",
      "FilePath": "%SYSTEM32%\\CONHOST.EXE",
      "FileHashLength": "0",
      "FileHash": "",
      "FqbnLength": "119",
      "Fqbn": "O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT® WINDOWS® OPERATING SYSTEM\\CONHOST.EXE\\10.0.22621.5415",
      "TargetLogonId": "0x31bfc8f",
      "FullFilePathLength": "32",
      "FullFilePath": "\\SystemRoot\\System32\\Conhost.exe"
    }
  },
  "message": "%SYSTEM32%\\CONHOST.EXE was allowed to run."
}

Detection Patterns #

Ti Map File Hash

AppLocker Event ID 8002: FilePathBuffer was allowed to run.OREvent ID 8003: RuleAndFileData.FilePath was allowed to run but would have been prevented from running if the AppLocker policy were enforced.OREvent ID 8005: FilePathBuffer was allowed to run.

2 rules

Kusto

TI Map File Hash to Security Event (source)

TI map File Hash to Security Event (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`FileHash`	is_not_null		1 rule	kusto
`FileHashValue`	is_not_null		1 rule	kusto
`IndicatorType`	eq	`file`	1 rule	kusto
`SecurityEvent_TimeGenerated`	cross_field_compare	`ExpirationDateTime`	1 rule	kusto
`SecurityEvent_TimeGenerated`	cross_field_compare	`ValidUntil`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

NTLM Logon source low: Detects logons using NTLM, which could be caused by a legacy source or attackersT1550, T1550.002

References #

Microsoft Learn

Event ID 8003: RuleAndFileData.FilePath was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Channel: EXE and DLL
Also via: realtime ETW trace
Level: Warning
Collection Priority: Recommended (Palantir, others)

Message #

%11 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Fields #

Name	Description
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString
`FileHashLength` UInt16
`FileHash` Binary
`FqbnLength` UInt16
`Fqbn` UnicodeString
`TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`FullFilePathLength` UInt16
`FullFilePathBuffer` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "event_source_name": "",
    "event_id": 8003,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-17T22:20:35.068824+00:00",
    "event_record_id": 1172833,
    "correlation": {},
    "execution": {
      "process_id": 4668,
      "thread_id": 13560
    },
    "channel": "Microsoft-Windows-AppLocker/EXE and DLL",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "RuleAndFileData": {
      "PolicyNameLength": 3,
      "PolicyName": "DLL",
      "RuleId": "00000000-0000-0000-0000-000000000000",
      "RuleNameLength": 1,
      "RuleName": "-",
      "RuleSddlLength": 1,
      "RuleSddl": "-",
      "TargetUser": "S-1-5-18",
      "TargetProcessId": 4668,
      "FilePathLength": 38,
      "FilePath": "%SYSTEM32%\\ONDEMANDCONNROUTEHELPER.DLL",
      "FileHashLength": 0,
      "FileHash": null,
      "FqbnLength": 1,
      "Fqbn": "-",
      "TargetLogonId": "0x3e7",
      "FullFilePathLength": 47,
      "FullFilePath": "C:\\Windows\\system32\\OnDemandConnRouteHelper.dll"
    }
  },
  "message": ""
}

Detection Patterns #

Ti Map File Hash

2 rules

Kusto

TI Map File Hash to Security Event (source)

TI map File Hash to Security Event (source)

Execution: JavaScript

AppLocker Event ID 8003: RuleAndFileData.FilePath was allowed to run but would have been prevented from running if the AppLocker policy were enforced.OREvent ID 8006: FilePathBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced.OREvent ID 8021: PackageBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced.OREvent ID 8024: PackageBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

1 rule

Sigma

AppLocker Application Would Have Been Blocked (source)

heyyanu

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`FileHash`	is_not_null		1 rule	kusto
`FileHashValue`	is_not_null		1 rule	kusto
`IndicatorType`	eq	`file`	1 rule	kusto
`SecurityEvent_TimeGenerated`	cross_field_compare	`ExpirationDateTime`	1 rule	kusto
`SecurityEvent_TimeGenerated`	cross_field_compare	`ValidUntil`	1 rule	kusto

References #

Microsoft Learn

Event ID 8004: FilePathBuffer was prevented from running.

Channel: EXE and DLL
Level: Error
Collection Priority: Recommended (Palantir, others)

Message #

%11 was prevented from running.

Fields #

Name	Description
`RuleAndFileData.PolicyNameLength` UInt16
`RuleAndFileData.PolicyName`
`RuleAndFileData.RuleId` GUID
`RuleAndFileData.RuleNameLength` UInt16
`RuleAndFileData.RuleName`
`RuleAndFileData.RuleSddlLength` UInt16
`RuleAndFileData.RuleSddl`
`RuleAndFileData.TargetUser` SID
`RuleAndFileData.TargetProcessId` UInt32	Process ID of the target process.
`RuleAndFileData.FilePathLength` UInt16
`RuleAndFileData.FilePath`
`RuleAndFileData.FileHashLength` UInt16
`RuleAndFileData.FileHash` Binary
`RuleAndFileData.FqbnLength` UInt16
`RuleAndFileData.Fqbn` UnicodeString
`RuleAndFileData.TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`RuleAndFileData.FullFilePathLength` UInt16
`RuleAndFileData.FullFilePath`
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString
`FileHashLength` UInt16
`FileHash` Binary
`FqbnLength` UInt16
`Fqbn` UnicodeString
`TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`FullFilePathLength` UInt16
`FullFilePathBuffer` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8004,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T14:14:55.0568115+00:00",
    "event_record_id": 1186892,
    "correlation": {},
    "execution": {
      "process_id": 8020,
      "thread_id": 4872
    },
    "channel": "Microsoft-Windows-AppLocker/EXE and DLL",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "RuleAndFileData": {
      "PolicyNameLength": "3",
      "PolicyName": "EXE",
      "RuleId": "{aa000001-0000-0000-0000-00000000d001}",
      "RuleNameLength": "19",
      "RuleName": "ALTest-Deny-TestExe",
      "RuleSddlLength": "70",
      "RuleSddl": "D:(XD;;FX;;;S-1-1-0;(APPID://PATH Contains \"C:\\PROGRAMDATA\\ALTEST\\*\"))",
      "TargetUser": "S-1-5-21-1006758700-2167138679-1475694448-1105",
      "TargetProcessId": "3096",
      "FilePathLength": "46",
      "FilePath": "%OSDRIVE%\\PROGRAMDATA\\ALTEST\\ALTEST_DENIED.EXE",
      "FileHashLength": "0",
      "FileHash": "",
      "FqbnLength": "115",
      "Fqbn": "O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT® WINDOWS® OPERATING SYSTEM\\CMD.EXE\\10.0.22621.5840",
      "TargetLogonId": "0x315f46f",
      "FullFilePathLength": "39",
      "FullFilePath": "C:\\ProgramData\\ALTest\\altest_denied.exe"
    }
  },
  "message": "%OSDRIVE%\\PROGRAMDATA\\ALTEST\\ALTEST_DENIED.EXE was prevented from running."
}

Detection Patterns #

Execution: JavaScript

AppLocker Event ID 8004: FilePathBuffer was prevented from running.OREvent ID 8007: FilePathBuffer was prevented from running.OREvent ID 8022: PackageBuffer was prevented from running.OREvent ID 8025: PackageBuffer was prevented from running.

1 rule

Sigma

AppLocker Prevented Application or Script from Running (source)

Pushkarev Dmitry

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk # view in coverage

Windows AppLocker Block Events source: The following analytic detects attempts to bypass application restrictions by identifying Windows AppLocker policy violations. It leverages Windows AppLocker event logs, specifically EventCodes 8007, 8004, 8022, 8025, 8029, and 8040, to…T1218↳ also matches Event ID 8007: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8025: PackageBuffer was prevented from running., Event ID 8022: PackageBuffer was prevented from running.
Windows AppLocker Privilege Escalation via Unauthorized Bypass source: The following analytic utilizes Windows AppLocker event logs to identify attempts to bypass application restrictions. AppLocker is a feature that allows administrators to specify which applications are permitted to run on a system. This…T1218↳ also matches Event ID 8007: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8025: PackageBuffer was prevented from running., Event ID 8022: PackageBuffer was prevented from running.

References #

Microsoft Learn

Event ID 8005: FilePathBuffer was allowed to run.

Channel: MSI and Script
Level: Informational
Collection Priority: Recommended (NSA, others)

Message #

%11 was allowed to run.

Fields #

Name	Description
`RuleAndFileData.PolicyNameLength` UInt16
`RuleAndFileData.PolicyName`
`RuleAndFileData.RuleId` GUID
`RuleAndFileData.RuleNameLength` UInt16
`RuleAndFileData.RuleName`
`RuleAndFileData.RuleSddlLength` UInt16
`RuleAndFileData.RuleSddl`
`RuleAndFileData.TargetUser` SID
`RuleAndFileData.TargetProcessId` UInt32	Process ID of the target process.
`RuleAndFileData.FilePathLength` UInt16
`RuleAndFileData.FilePath`
`RuleAndFileData.FileHashLength` UInt16
`RuleAndFileData.FileHash` Binary
`RuleAndFileData.FqbnLength` UInt16
`RuleAndFileData.Fqbn` UnicodeString
`RuleAndFileData.TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`RuleAndFileData.FullFilePathLength` UInt16
`RuleAndFileData.FullFilePath`
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString
`FileHashLength` UInt16
`FileHash` Binary
`FqbnLength` UInt16
`Fqbn` UnicodeString
`TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`FullFilePathLength` UInt16
`FullFilePathBuffer` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8005,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T14:14:51.5552713+00:00",
    "event_record_id": 9,
    "correlation": {
      "ActivityID": "{852E7D3D-86DF-4116-8BA8-601187FFCF75}"
    },
    "execution": {
      "process_id": 5080,
      "thread_id": 5184
    },
    "channel": "Microsoft-Windows-AppLocker/MSI and Script",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "RuleAndFileData": {
      "PolicyNameLength": "6",
      "PolicyName": "SCRIPT",
      "RuleId": "{bb000001-0000-0000-0000-00000000a003}",
      "RuleNameLength": "25",
      "RuleName": "ALTest-Allow-Script-Users",
      "RuleSddlLength": "64",
      "RuleSddl": "D:(XA;;FX;;;S-1-1-0;(APPID://PATH Contains \"%OSDRIVE%\\USERS\\*\"))",
      "TargetUser": "S-1-5-21-1006758700-2167138679-1475694448-1105",
      "TargetProcessId": "5080",
      "FilePathLength": "84",
      "FilePath": "%OSDRIVE%\\USERS\\DOMAINADMIN\\APPDATA\\LOCAL\\TEMP\\__PSSCRIPTPOLICYTEST_FUGE3UXW.0Q4.PS1",
      "FileHashLength": "0",
      "FileHash": "",
      "FqbnLength": "1",
      "Fqbn": "-",
      "TargetLogonId": "0x31bfc8f",
      "FullFilePathLength": "77",
      "FullFilePath": "C:\\Users\\domainadmin\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fuge3uxw.0q4.ps1"
    }
  },
  "message": "%OSDRIVE%\\USERS\\DOMAINADMIN\\APPDATA\\LOCAL\\TEMP\\__PSSCRIPTPOLICYTEST_FUGE3UXW.0Q4.PS1 was allowed to run."
}

Detection Patterns #

Ti Map File Hash

2 rules

Kusto

TI Map File Hash to Security Event (source)

TI map File Hash to Security Event (source)

Credential Access: Password Spraying

AppLocker Event ID 8005: FilePathBuffer was allowed to run.ORNTLM Event ID 8004: NTLM authentication in this domain audit (domain controller): Audit NTLM authentication in this domain.OREvent ID 8006: NTLM authentication in this domain audit (domain controller), event 8006.

1 rule

Splunk

Windows Multiple NTLM Null Domain Authentications (source)

Steven Dick

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`SChannelName`	cross_field_compare	`src`	5 rules	splunk
`SChannelName`	eq	`*`	4 rules	splunk
`isOutlier`	eq	`1`	5 rules	splunk
`sourcetype`	eq	`xmlwineventlog:microsoft-windows-ntlm/operational`	5 rules	splunk
`WorkstationName`	eq	`*`	4 rules	splunk
`FileHash`	is_not_null		1 rule	kusto
`FileHashValue`	is_not_null		1 rule	kusto
`IndicatorType`	eq	`file`	1 rule	kusto
`SecurityEvent_TimeGenerated`	cross_field_compare	`ExpirationDateTime`	1 rule	kusto
`SecurityEvent_TimeGenerated`	cross_field_compare	`ValidUntil`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk # view in coverage

Windows Unusual NTLM Authentication Destinations By Source source: The following analytic detects when an unusual number NTLM authentications is attempted by the same source against multiple destinations. This activity generally results when an attacker attempts to brute force, password spray, or…T1110, T1110.003
Windows Unusual NTLM Authentication Destinations By User source: The following analytic detects when an unusual number of NTLM authentications is attempted by the same user account against multiple destinations. This activity generally results when an attacker attempts to brute force, password spray, or…T1110, T1110.003
Windows Unusual NTLM Authentication Users By Destination source: The following analytic detects when a device is the target of numerous NTLM authentications using a null domain. This activity generally results when an attacker attempts to brute force, password spray, or otherwise authenticate to a…T1110, T1110.003

Show 1 more (4 total) on the rules page

References #

Microsoft Learn

Event ID 8006: FilePathBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Channel: MSI and Script
Also via: realtime ETW trace
Level: Warning
Collection Priority: Recommended (NSA, others)

Message #

%11 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Fields #

Name	Description
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString
`FileHashLength` UInt16
`FileHash` Binary
`FqbnLength` UInt16
`Fqbn` UnicodeString
`TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`FullFilePathLength` UInt16
`FullFilePathBuffer` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8006,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": "0x4000000000000000",
    "time_created": "2026-06-02T17:34:50.927+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{AE3ADFDF-F2B5-0003-07F0-3AAEB5F2DC01}"
    },
    "execution": {
      "process_id": 6096,
      "thread_id": 6128
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FileHash": "96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7",
    "FileHashLength": 32,
    "FilePathBuffer": "%OSDRIVE%\\USERS\\LOCALUSER\\APPDATA\\LOCAL\\TEMP\\__PSSCRIPTPOLICYTEST_JHWC5UKO.ZUV.PS1",
    "FilePathLength": 82,
    "Fqbn": "-",
    "FqbnLength": 1,
    "FullFilePathBuffer": "C:\\Users\\localuser\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jhwc5uko.zuv.ps1",
    "FullFilePathLength": 75,
    "PolicyNameBuffer": "SCRIPT",
    "PolicyNameLength": 6,
    "RuleId": "{00000000-0000-0000-0000-000000000000}",
    "RuleNameBuffer": "-",
    "RuleNameLength": 1,
    "RuleSddlBuffer": "-",
    "RuleSddlLength": 1,
    "TargetLogonId": "9F74080000000000",
    "TargetProcessId": 6096,
    "TargetUser": "DESKTOP-FF3N5XK\\localuser"
  },
  "message": ""
}

Detection Patterns #

Execution: JavaScript

1 rule

Sigma

AppLocker Application Would Have Been Blocked (source)

heyyanu

References #

Microsoft Learn

Event ID 8007: FilePathBuffer was prevented from running.

Channel: MSI and Script
Level: Error
Collection Priority: Recommended (NSA, others)

Message #

%11 was prevented from running.

Fields #

Name	Description
`RuleAndFileData.PolicyNameLength` UInt16
`RuleAndFileData.PolicyName`
`RuleAndFileData.RuleId` GUID
`RuleAndFileData.RuleNameLength` UInt16
`RuleAndFileData.RuleName`
`RuleAndFileData.RuleSddlLength` UInt16
`RuleAndFileData.RuleSddl`
`RuleAndFileData.TargetUser` SID
`RuleAndFileData.TargetProcessId` UInt32	Process ID of the target process.
`RuleAndFileData.FilePathLength` UInt16
`RuleAndFileData.FilePath`
`RuleAndFileData.FileHashLength` UInt16
`RuleAndFileData.FileHash` Binary
`RuleAndFileData.FqbnLength` UInt16
`RuleAndFileData.Fqbn` UnicodeString
`RuleAndFileData.TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`RuleAndFileData.FullFilePathLength` UInt16
`RuleAndFileData.FullFilePath`
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString
`FileHashLength` UInt16
`FileHash` Binary
`FqbnLength` UInt16
`Fqbn` UnicodeString
`TargetLogonId` HexInt64	Logon session identifier (LUID) for the target.
`FullFilePathLength` UInt16
`FullFilePathBuffer` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8007,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T15:36:09.0839691+00:00",
    "event_record_id": 135,
    "correlation": {},
    "execution": {
      "process_id": 6536,
      "thread_id": 7128
    },
    "channel": "Microsoft-Windows-AppLocker/MSI and Script",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "RuleAndFileData": {
      "PolicyNameLength": "6",
      "PolicyName": "SCRIPT",
      "RuleId": "{aaaaaaa2-0000-0000-0000-000000000002}",
      "RuleNameLength": "16",
      "RuleName": "Deny test script",
      "RuleSddlLength": "73",
      "RuleSddl": "D:(XD;;FX;;;S-1-1-0;(APPID://PATH Contains \"%OSDRIVE%\\APPLOCKER_TEST\\*\"))",
      "TargetUser": "S-1-5-21-1006758700-2167138679-1475694448-1105",
      "TargetProcessId": "6536",
      "FilePathLength": "36",
      "FilePath": "%OSDRIVE%\\APPLOCKER_TEST\\BLOCKED.BAT",
      "FileHashLength": "0",
      "FileHash": "",
      "FqbnLength": "1",
      "Fqbn": "-",
      "TargetLogonId": "0x6ee77",
      "FullFilePathLength": "29",
      "FullFilePath": "C:\\applocker_test\\blocked.bat"
    }
  },
  "message": "%OSDRIVE%\\APPLOCKER_TEST\\BLOCKED.BAT was prevented from running."
}

Detection Patterns #

Execution: JavaScript

1 rule

Sigma

AppLocker Prevented Application or Script from Running (source)

Pushkarev Dmitry

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk # view in coverage

Windows AppLocker Block Events source: The following analytic detects attempts to bypass application restrictions by identifying Windows AppLocker policy violations. It leverages Windows AppLocker event logs, specifically EventCodes 8007, 8004, 8022, 8025, 8029, and 8040, to…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8025: PackageBuffer was prevented from running., Event ID 8022: PackageBuffer was prevented from running.
Windows AppLocker Privilege Escalation via Unauthorized Bypass source: The following analytic utilizes Windows AppLocker event logs to identify attempts to bypass application restrictions. AppLocker is a feature that allows administrators to specify which applications are permitted to run on a system. This…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8025: PackageBuffer was prevented from running., Event ID 8022: PackageBuffer was prevented from running.

References #

Microsoft Learn

Event ID 8008: FilePathBuffer: AppLocker component not available on this SKU.

Channel: EXE and DLL
Collection Priority: Recommended (ASD, others)

Message #

%2: AppLocker component not available on this SKU.

Fields #

Name	Description
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString

Event ID 8009: FilePathBuffer: AppLocker component not available on this SKU.

Channel: MSI and Script
Collection Priority: Recommended (Olaf Hartong)

Message #

%2: AppLocker component not available on this SKU.

Fields #

Name	Description
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString

Event ID 8010: SrpPolicyConversionStart

Channel: Operational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyConversion
Opcode: Start

Event ID 8011: SrpPolicyConversionStop

Channel: Operational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyConversion
Opcode: Stop

Event ID 8012: SrpPolicyConversionStop8012

Channel: Operational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyConversion
Opcode: Stop

Event ID 8013: SrpPolicyRuleSortStart

Channel: Operational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyRuleSort
Opcode: Start

Event ID 8014: SrpPolicyRuleSortStop

Channel: Operational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyRuleSort
Opcode: Stop

Event ID 8015: SrpPolicyHitCountJoinStart

Channel: Operational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyHitCountJoin
Opcode: Start

Event ID 8016: SrpPolicyHitCountJoinStop

Channel: Operational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyHitCountJoin
Opcode: Stop

Event ID 8017: SrpPolicyLoad

Channel: Operational
Level: Informational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyLoad
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8017,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 1,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:56:30.673+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 948,
      "thread_id": 5404
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SrpPolicyLoad"
}

Event ID 8018: SrpPolicyLoad

Channel: Operational
Level: Informational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyLoad
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8018,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T06:56:30.673+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 948,
      "thread_id": 5404
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "SrpPolicyLoad"
}

Event ID 8019: SrpPolicyLoadStop8019

Channel: Operational
Collection Priority: Recommended (Olaf Hartong)
Task: SrpPolicyLoad
Opcode: Stop

Event ID 8020: PackageBuffer was allowed to run.

Channel: Packaged app-Execution
Level: Informational
Collection Priority: Recommended (NSA, others)

Message #

%11 was allowed to run.

Fields #

Name	Description
`RuleAndFileData.PolicyNameLength` UInt16
`RuleAndFileData.PolicyName`
`RuleAndFileData.RuleId` GUID
`RuleAndFileData.RuleNameLength` UInt16
`RuleAndFileData.RuleName`
`RuleAndFileData.RuleSddlLength` UInt16
`RuleAndFileData.RuleSddl`
`RuleAndFileData.TargetUser` SID
`RuleAndFileData.TargetProcessId` UInt32	Process ID of the target process.
`RuleAndFileData.PackageLength` UInt16
`RuleAndFileData.Package`
`RuleAndFileData.FqbnLength` UInt16
`RuleAndFileData.Fqbn` UnicodeString
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`PackageLength` UInt16
`PackageBuffer` UnicodeString
`FqbnLength` UInt16
`Fqbn` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8020,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-05-30T15:34:11.4085161+00:00",
    "event_record_id": 70,
    "correlation": {},
    "execution": {
      "process_id": 9464,
      "thread_id": 3544
    },
    "channel": "Microsoft-Windows-AppLocker/Packaged app-Execution",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "RuleAndFileData": {
      "PolicyNameLength": "4",
      "PolicyName": "APPX",
      "RuleId": "{cc000001-0000-0000-0000-00000000a001}",
      "RuleNameLength": "28",
      "RuleName": "ALTest-Allow-AllPackagedApps",
      "RuleSddlLength": "81",
      "RuleSddl": "D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\"*\\*\\*\",0}))))",
      "TargetUser": "S-1-5-21-1006758700-2167138679-1475694448-1105",
      "TargetProcessId": "8036",
      "PackageLength": "37",
      "Package": "MICROSOFTWINDOWS.CLIENT.WEBEXPERIENCE",
      "FqbnLength": "149",
      "Fqbn": "CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFTWINDOWS.CLIENT.WEBEXPERIENCE\\MSEDGEWEBVIEW2.EXE\\526.11701.40.00"
    }
  },
  "message": "MICROSOFTWINDOWS.CLIENT.WEBEXPERIENCE was allowed to run."
}

Event ID 8021: PackageBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Channel: Packaged app-Execution
Level: Warning
Collection Priority: Recommended (Olaf Hartong)

Message #

%11 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Fields #

Name	Description
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`PackageLength` UInt16
`PackageBuffer` UnicodeString
`FqbnLength` UInt16
`Fqbn` UnicodeString

Example Event #

{
  "message": "",
  "system": {
    "channel": "Microsoft-Windows-AppLocker/Packaged app-Execution",
    "computer": "WORKSTATION.example.local",
    "correlation": {},
    "event_id": 8021,
    "event_record_id": 2389,
    "event_source_name": "",
    "execution": {
      "process_id": 7700,
      "thread_id": 8668
    },
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "keywords": 2305843009213693952,
    "level": 3,
    "opcode": 0,
    "provider": "Microsoft-Windows-AppLocker",
    "security": {
      "user_id": "S-1-5-21-000000000-000000000-000000000-1105"
    },
    "task": 0,
    "time_created": "2026-07-21T00:36:22.100318+00:00",
    "version": 0
  },
  "user_data": {
    "RuleAndFileData": {
      "Fqbn": "E=DON.H@FREE.FR, CN=%22NOTEPAD++%22, O=%22NOTEPAD++%22, L=PARIS, S=ÎLE-DE-FRANCE, C=FR\\NOTEPADPLUSPLUS\\GUP.EXE\\1.0.0.00",
      "FqbnLength": 119,
      "Package": "NOTEPADPLUSPLUS",
      "PackageLength": 15,
      "PolicyName": "APPX",
      "PolicyNameLength": 4,
      "RuleId": "E1DAF5D2-C82C-47D2-9882-34BEAE7BCE9E",
      "RuleName": "DW-CAPTURE Deny NotepadPlusPlus",
      "RuleNameLength": 31,
      "RuleSddl": "D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && (((APPID://FQBN) >= ({\"E=DON.H@FREE.FR, CN=%22NOTEPAD++%22, O=%22NOTEPAD++%22, L=PARIS, S=ÎLE-DE-FRANCE, C=FR\\NOTEPADPLUSPLUS\\*\",281474976710656})) && ((APPID://FQBN) <= ({\"E=DON.H@FREE.FR, CN=%22NOTEPAD++%2...",
      "RuleSddlLength": 256,
      "TargetProcessId": 10612,
      "TargetUser": "S-1-5-21-000000000-000000000-000000000-1105"
    }
  }
}

Detection Patterns #

Execution: JavaScript

1 rule

Sigma

AppLocker Application Would Have Been Blocked (source)

heyyanu

Event ID 8022: PackageBuffer was prevented from running.

Channel: Packaged app-Execution
Collection Priority: Recommended (ASD, others)

Message #

%11 was prevented from running.

Fields #

Name	Description
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`PackageLength` UInt16
`PackageBuffer` UnicodeString
`FqbnLength` UInt16
`Fqbn` UnicodeString

Detection Patterns #

Execution: JavaScript

1 rule

Sigma

AppLocker Prevented Application or Script from Running (source)

Pushkarev Dmitry

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk # view in coverage

Windows AppLocker Block Events source: The following analytic detects attempts to bypass application restrictions by identifying Windows AppLocker policy violations. It leverages Windows AppLocker event logs, specifically EventCodes 8007, 8004, 8022, 8025, 8029, and 8040, to…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8007: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8025: PackageBuffer was prevented from running.
Windows AppLocker Privilege Escalation via Unauthorized Bypass source: The following analytic utilizes Windows AppLocker event logs to identify attempts to bypass application restrictions. AppLocker is a feature that allows administrators to specify which applications are permitted to run on a system. This…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8007: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8025: PackageBuffer was prevented from running.

Event ID 8023: PackageBuffer was allowed to be installed.

Channel: Packaged app-Deployment
Level: Informational
Collection Priority: Recommended (NSA, others)

Message #

%11 was allowed to be installed.

Fields #

Name	Description
`RuleAndFileData.PolicyNameLength` UInt16
`RuleAndFileData.PolicyName`
`RuleAndFileData.RuleId` GUID
`RuleAndFileData.RuleNameLength` UInt16
`RuleAndFileData.RuleName`
`RuleAndFileData.RuleSddlLength` UInt16
`RuleAndFileData.RuleSddl`
`RuleAndFileData.TargetUser` SID
`RuleAndFileData.TargetProcessId` UInt32	Process ID of the target process.
`RuleAndFileData.PackageLength` UInt16
`RuleAndFileData.Package`
`RuleAndFileData.FqbnLength` UInt16
`RuleAndFileData.Fqbn` UnicodeString
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`PackageLength` UInt16
`PackageBuffer` UnicodeString
`FqbnLength` UInt16
`Fqbn` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8023,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2026-05-30T15:32:32.5187947+00:00",
    "event_record_id": 44,
    "correlation": {
      "ActivityID": "{55C1F16C-F047-0006-7E5F-C25547F0DC01}"
    },
    "execution": {
      "process_id": 7684,
      "thread_id": 8516
    },
    "channel": "Microsoft-Windows-AppLocker/Packaged app-Deployment",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "RuleAndFileData": {
      "PolicyNameLength": "4",
      "PolicyName": "APPX",
      "RuleId": "{cc000001-0000-0000-0000-00000000a001}",
      "RuleNameLength": "28",
      "RuleName": "ALTest-Allow-AllPackagedApps",
      "RuleSddlLength": "81",
      "RuleSddl": "D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\"*\\*\\*\",0}))))",
      "TargetUser": "S-1-5-21-1006758700-2167138679-1475694448-1105",
      "TargetProcessId": "7684",
      "PackageLength": "32",
      "Package": "Microsoft.WidgetsPlatformRuntime",
      "FqbnLength": "128",
      "Fqbn": "CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.WIDGETSPLATFORMRUNTIME\\APPX\\1.6.18.00"
    }
  },
  "message": "Microsoft.WidgetsPlatformRuntime was allowed to be installed."
}

Event ID 8024: PackageBuffer was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Channel: Packaged app-Deployment
Level: Warning
Collection Priority: Recommended (Olaf Hartong)

Message #

%11 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Fields #

Name	Description
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`PackageLength` UInt16
`PackageBuffer` UnicodeString
`FqbnLength` UInt16
`Fqbn` UnicodeString

Example Event #

{
  "message": "",
  "system": {
    "channel": "Microsoft-Windows-AppLocker/Packaged app-Deployment",
    "computer": "WORKSTATION.example.local",
    "correlation": {
      "ActivityID": "269052C9-17A3-000B-30E6-9026A317DD01"
    },
    "event_id": 8024,
    "event_record_id": 251,
    "event_source_name": "",
    "execution": {
      "process_id": 9104,
      "thread_id": 8936
    },
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "keywords": 1152921504606846976,
    "level": 3,
    "opcode": 0,
    "provider": "Microsoft-Windows-AppLocker",
    "security": {
      "user_id": "S-1-5-21-000000000-000000000-000000000-1105"
    },
    "task": 0,
    "time_created": "2026-07-21T00:36:18.059900+00:00",
    "version": 0
  },
  "user_data": {
    "RuleAndFileData": {
      "Fqbn": "E=DON.H@FREE.FR, CN=%22NOTEPAD++%22, O=%22NOTEPAD++%22, L=PARIS, S=ÎLE-DE-FRANCE, C=FR\\NOTEPADPLUSPLUS\\APPX\\1.0.0.00",
      "FqbnLength": 116,
      "Package": "NotepadPlusPlus",
      "PackageLength": 15,
      "PolicyName": "APPX",
      "PolicyNameLength": 4,
      "RuleId": "E1DAF5D2-C82C-47D2-9882-34BEAE7BCE9E",
      "RuleName": "DW-CAPTURE Deny NotepadPlusPlus",
      "RuleNameLength": 31,
      "RuleSddl": "D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && (((APPID://FQBN) >= ({\"E=DON.H@FREE.FR, CN=%22NOTEPAD++%22, O=%22NOTEPAD++%22, L=PARIS, S=ÎLE-DE-FRANCE, C=FR\\NOTEPADPLUSPLUS\\*\",281474976710656})) && ((APPID://FQBN) <= ({\"E=DON.H@FREE.FR, CN=%22NOTEPAD++%2...",
      "RuleSddlLength": 256,
      "TargetProcessId": 9104,
      "TargetUser": "S-1-5-21-000000000-000000000-000000000-1105"
    }
  }
}

Detection Patterns #

Execution: JavaScript

1 rule

Sigma

AppLocker Application Would Have Been Blocked (source)

heyyanu

Event ID 8025: PackageBuffer was prevented from running.

Channel: Packaged app-Deployment
Level: Error
Collection Priority: Recommended (ASD, others)

Message #

%11 was prevented from running.

Fields #

Name	Description
`PolicyNameLength` UInt16
`PolicyNameBuffer` UnicodeString
`RuleId` GUID
`RuleNameLength` UInt16
`RuleNameBuffer` UnicodeString
`RuleSddlLength` UInt16
`RuleSddlBuffer` UnicodeString
`TargetUser` SID
`TargetProcessId` UInt32	Process ID of the target process.
`PackageLength` UInt16
`PackageBuffer` UnicodeString
`FqbnLength` UInt16
`Fqbn` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "event_source_name": "",
    "event_id": 8025,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 1152921504606846976,
    "time_created": "2026-08-05T23:17:16.170835+00:00",
    "event_record_id": 263,
    "correlation": {
      "ActivityID": "D1F889C6-24B0-0007-42B2-FAD1B024DD01"
    },
    "execution": {
      "process_id": 1388,
      "thread_id": 8772
    },
    "channel": "Microsoft-Windows-AppLocker/Packaged app-Deployment",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "RuleAndFileData": {
      "PolicyNameLength": 4,
      "PolicyName": "APPX",
      "RuleId": "9F1C0000-0000-4000-8000-00000000A302",
      "RuleNameLength": 32,
      "RuleName": "dwh deny the induction publisher",
      "RuleSddlLength": 97,
      "RuleSddl": "D:(XD;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\"CN=DWHAPPXBLOCKED\\*\\*\",0}))))",
      "TargetUser": "S-1-5-21-1006758700-2167138679-1475694448-1105",
      "TargetProcessId": 1388,
      "PackageLength": 40,
      "Package": "dwhappx.57ee64f7944843ee9e0e87c32ff15f5b",
      "FqbnLength": 72,
      "Fqbn": "CN=DWHAPPXBLOCKED\\DWHAPPX.57EE64F7944843EE9E0E87C32FF15F5B\\APPX\\1.0.0.00"
    }
  },
  "message": ""
}

Detection Patterns #

Execution: JavaScript

1 rule

Sigma

AppLocker Prevented Application or Script from Running (source)

Pushkarev Dmitry

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk # view in coverage

Windows AppLocker Block Events source: The following analytic detects attempts to bypass application restrictions by identifying Windows AppLocker policy violations. It leverages Windows AppLocker event logs, specifically EventCodes 8007, 8004, 8022, 8025, 8029, and 8040, to…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8007: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8022: PackageBuffer was prevented from running.
Windows AppLocker Privilege Escalation via Unauthorized Bypass source: The following analytic utilizes Windows AppLocker event logs to identify attempts to bypass application restrictions. AppLocker is a feature that allows administrators to specify which applications are permitted to run on a system. This…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8007: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8022: PackageBuffer was prevented from running.

Event ID 8026: No packaged apps can be executed while Exe rules are being enforced and no Packaged app rules have been configured.

Channel: Packaged app-Deployment
Collection Priority: Recommended (Olaf Hartong)

Event ID 8027: No packaged apps can be executed while Exe rules are being enforced and no Packaged app rules have been configured.

Channel: Packaged app-Execution
Collection Priority: Recommended (ASD, others)

Event ID 8028: FilePath was allowed to run but would have been prevented if the Config CI policy were enforced.

Channel: MSI and Script
Level: Warning

Message #

%2 was allowed to run but would have been prevented if the Config CI policy were enforced.

Fields #

Name	Description
`FilePathLength` UInt16
`FilePath` UnicodeString
`Sha1Hash` Binary
`Sha256Hash` Binary
`Result` Int32
`USN` Int64
`Sha1CatalogHash` Binary
`Sha256CatalogHash` Binary
`UserWriteable` Boolean
`DetachedSignatureFilePathLength`
`DetachedSignatureFilePath`
`OriginalFileNameLength`
`OriginalFilename`
`InternalNameLength`
`InternalName`
`FileDescriptionLength`
`FileDescription`
`ProductNameLength`
`ProductName`
`FileVersionLength`
`FileVersion`
`PolicyNameLength`
`PolicyName`
`PolicyIDLength`
`PolicyID`
`PolicyGUID`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "event_source_name": "",
    "event_id": 8028,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-06T00:54:55.214802+00:00",
    "event_record_id": 241,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0001-6B7D-E5E43710DA01"
    },
    "execution": {
      "process_id": 12792,
      "thread_id": 6736
    },
    "channel": "Microsoft-Windows-AppLocker/MSI and Script",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FilePathLength": 70,
    "FilePath": "C:\\Windows\\Installer\\{6F11CAC3-D33D-4360-B139-73F3276A2B9A}\\loc.en.mst",
    "Sha1Hash": "C9FD8657FD8262EF19369B5FB6CAA7CB7632FC87",
    "Sha256Hash": "3881BD701A2B9DE71742065AADC110FBFFD17F127785FDA4E17570A77FC3FA84",
    "Result": -790036478,
    "USN": 309169000,
    "Sha1CatalogHash": "C9FD8657FD8262EF19369B5FB6CAA7CB7632FC87",
    "Sha256CatalogHash": "9A71D576BC994B8C6DCFA683B38313596DCE7774784D46EFC5FE5D97724043BC",
    "UserWriteable": false
  },
  "message": ""
}

References #

Microsoft Learn
Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 8029: FilePath was prevented from running due to Config CI policy.

Channel: MSI and Script
Level: Error
Collection Priority: Recommended (ASD)

Message #

%2 was prevented from running due to Config CI policy.

Fields #

Name	Description
`FilePathLength` UInt16
`FilePath` UnicodeString
`Sha1Hash` Binary
`Sha256Hash` Binary
`Result` Int32
`USN` Int64
`Sha1CatalogHash` Binary
`Sha256CatalogHash` Binary
`UserWriteable` Boolean
`DetachedSignatureFilePathLength` UInt16
`DetachedSignatureFilePath` UnicodeString
`OriginalFileNameLength` UInt16
`OriginalFilename` UnicodeString
`InternalNameLength` UInt16
`InternalName` UnicodeString
`FileDescriptionLength` UInt16
`FileDescription` UnicodeString
`ProductNameLength` UInt16
`ProductName` UnicodeString
`FileVersionLength` UInt16
`FileVersion` UnicodeString
`PolicyNameLength` UInt16
`PolicyName` UnicodeString
`PolicyIDLength` UInt16
`PolicyID` UnicodeString
`PolicyGUID` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}",
    "event_source_name": "",
    "event_id": 8029,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T14:47:49.0454544+00:00",
    "event_record_id": 53,
    "correlation": {
      "ActivityID": "{01270331-F043-000C-7B06-270143F0DC01}"
    },
    "execution": {
      "process_id": 8672,
      "thread_id": 8852
    },
    "channel": "Microsoft-Windows-AppLocker/MSI and Script",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FilePathLength": "190",
    "FilePath": "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection\\8824.15672628.0.15672628-8b171f9ec9ed2bf3419a2050d3b34777657e0caf\\05f2c576-9ed5-41eb-9b1e-1b653eebfdff.ps1",
    "Sha1Hash": "A33BA45F00EB5ED27A1F94E26427C236AAC525F6",
    "Sha256Hash": "A7012F1C99D806B1241D617B735C478135EA18E699E36F675FC68D8265D4148D",
    "Result": "-790036478",
    "USN": "2273922288",
    "Sha1CatalogHash": "A33BA45F00EB5ED27A1F94E26427C236AAC525F6",
    "Sha256CatalogHash": "82CF9DB102B7054E4344C430C45E02C8D0C9801DEB410A6B416BF2E3764D308B",
    "UserWriteable": "false"
  },
  "message": "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection\\8824.15672628.0.15672628-8b171f9ec9ed2bf3419a2050d3b34777657e0caf\\05f2c576-9ed5-41eb-9b1e-1b653eebfdff.ps1 was prevented from running due to Config CI policy."
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk # view in coverage

Windows AppLocker Block Events source: The following analytic detects attempts to bypass application restrictions by identifying Windows AppLocker policy violations. It leverages Windows AppLocker event logs, specifically EventCodes 8007, 8004, 8022, 8025, 8029, and 8040, to…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8007: FilePathBuffer was prevented from running., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8025: PackageBuffer was prevented from running., Event ID 8022: PackageBuffer was prevented from running.
Windows AppLocker Privilege Escalation via Unauthorized Bypass source: The following analytic utilizes Windows AppLocker event logs to identify attempts to bypass application restrictions. AppLocker is a feature that allows administrators to specify which applications are permitted to run on a system. This…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8007: FilePathBuffer was prevented from running., Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength)., Event ID 8025: PackageBuffer was prevented from running., Event ID 8022: PackageBuffer was prevented from running.

References #

Microsoft Learn

Event ID 8030: ManagedInstaller check SUCCEEDED during Appid verification of ImageNameLength.

Channel: EXE and DLL

Description

ManagedInstaller check SUCCEEDED during Appid verification of.

Message #

ManagedInstaller check SUCCEEDED during Appid verification of
%2.
Status: %5

Fields #

Name	Description
`ImageNameLength` UInt16
`ImageName` UnicodeString
`ParentProcessLength` UInt16
`ParentProcess` AnsiString
`StatusCode` HexInt32	NTSTATUS reference
`AppLockerReason` UInt32
`Bucket` UInt32
`USN` UInt64
`NtfsFileIdSize` UInt16
`NtfsFileId` Binary
`OriginDataPresent` Boolean
`SessionId` GUID
`SubSessionId` GUID
`Origin` UInt32	Known values `0` Managed Installer (MI) - file origin tracked via a managed installer process `1` Intelligent Security Graph (ISG) - file origin tracked via ISG reputation
`Type` UInt32
`Generation` UInt32
`SmartScreen` UInt32
`RevocationID` UInt32
`DataLength` UInt16
`Data` UnicodeString

Event ID 8031: SmartlockerFilter detected file FileName being written by process CurrentProcess.

Channel: EXE and DLL

Message #

SmartlockerFilter detected file %2 being written by process %4.

Fields #

Name	Description
`FileNameLength` UInt16
`FileName` UnicodeString
`CurrentProcessLength` UInt16
`CurrentProcess` AnsiString
`ParentProcessLength` UInt16
`ParentProcess` AnsiString
`USN` UInt64
`NtfsFileIdSize` UInt16
`NtfsFileId` Binary
`OriginDataPresent` Boolean
`SessionId` GUID
`Origin` UInt32	Known values `0` Managed Installer (MI) - file origin tracked via a managed installer process `1` Intelligent Security Graph (ISG) - file origin tracked via ISG reputation
`Type` UInt32
`Generation` UInt32
`SmartScreen` UInt32
`DataLength` UInt16
`Data` UnicodeString

Event ID 8032: ManagedInstaller check FAILED during Appid verification of ImageNameLength.

Channel: EXE and DLL
Collection Priority: Recommended (ASD)

Description

ManagedInstaller check FAILED during Appid verification of.

Message #

ManagedInstaller check FAILED during Appid verification of
%2.
Status: %5

Fields #

Name	Description
`ImageNameLength` UInt16
`ImageName` UnicodeString
`ParentProcessLength` UInt16
`ParentProcess` AnsiString
`StatusCode` HexInt32	NTSTATUS reference
`AppLockerReason` UInt32
`Bucket` UInt32
`USN` UInt64
`NtfsFileIdSize` UInt16
`NtfsFileId` Binary
`OriginDataPresent` Boolean
`SessionId` GUID
`SubSessionId` GUID
`Origin` UInt32	Known values `0` Managed Installer (MI) - file origin tracked via a managed installer process `1` Intelligent Security Graph (ISG) - file origin tracked via ISG reputation
`Type` UInt32
`Generation` UInt32
`SmartScreen` UInt32
`RevocationID` UInt32
`DataLength` UInt16
`Data` UnicodeString

Event ID 8033: ManagedInstaller check FAILED during Appid verification of ImageNameLength.

Channel: EXE and DLL

Description

ManagedInstaller check FAILED during Appid verification of.

Message #

ManagedInstaller check FAILED during Appid verification of
%2.
Status: %5
Allowed to run due to Audit Applocker Policy

Fields #

Name	Description
`ImageNameLength` UInt16
`ImageName` UnicodeString
`ParentProcessLength` UInt16
`ParentProcess` AnsiString
`StatusCode` HexInt32	NTSTATUS reference
`AppLockerReason` UInt32
`Bucket` UInt32
`USN` UInt64
`NtfsFileIdSize` UInt16
`NtfsFileId` Binary
`OriginDataPresent` Boolean
`SessionId` GUID
`SubSessionId` GUID
`Origin` UInt32	Known values `0` Managed Installer (MI) - file origin tracked via a managed installer process `1` Intelligent Security Graph (ISG) - file origin tracked via ISG reputation
`Type` UInt32
`Generation` UInt32
`SmartScreen` UInt32
`RevocationID` UInt32
`DataLength` UInt16
`Data` UnicodeString

Event ID 8034: ManagedInstaller Script check FAILED during Appid verification of ImageNameLength.

Channel: MSI and Script

Description

ManagedInstaller Script check FAILED during Appid verification of.

Message #

ManagedInstaller Script check FAILED during Appid verification of
%2.
Status: %3

Fields #

Name	Description
`ImageNameLength` UInt16
`ImageName` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`Bucket` UInt32
`OriginDataPresent` Boolean
`SessionId` GUID
`SubSessionId` GUID
`Origin` UInt32	Known values `0` Managed Installer (MI) - file origin tracked via a managed installer process `1` Intelligent Security Graph (ISG) - file origin tracked via ISG reputation
`Type` UInt32
`Generation` UInt32
`SmartScreen` UInt32
`RevocationID` UInt32
`DataLength` UInt16
`Data` UnicodeString

Event ID 8035: ManagedInstaller Script check SUCCEEDED during Appid verification of ImageNameLength.

Channel: MSI and Script
Collection Priority: Recommended (ASD)

Description

ManagedInstaller Script check SUCCEEDED during Appid verification of.

Message #

ManagedInstaller Script check SUCCEEDED during Appid verification of
%2.
Status: %3

Fields #

Name	Description
`ImageNameLength` UInt16
`ImageName` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`Bucket` UInt32
`OriginDataPresent` Boolean
`SessionId` GUID
`SubSessionId` GUID
`Origin` UInt32	Known values `0` Managed Installer (MI) - file origin tracked via a managed installer process `1` Intelligent Security Graph (ISG) - file origin tracked via ISG reputation
`Type` UInt32
`Generation` UInt32
`SmartScreen` UInt32
`RevocationID` UInt32
`DataLength` UInt16
`Data` UnicodeString

Event ID 8036: CLSID was prevented from running due to Config CI policy.

Channel: MSI and Script
Collection Priority: Recommended (ASD)

Message #

%2 was prevented from running due to Config CI policy.

Fields #

Name	Description
`IsApproved` Boolean
`CLSID` GUID

References #

Microsoft Learn

Event ID 8037: FilePath passed Config CI policy and was allowed to run.

Channel: MSI and Script
Level: Informational

Message #

%2 passed Config CI policy and was allowed to run.

Fields #

Name	Description
`FilePathLength` UInt16
`FilePath` UnicodeString
`Sha1Hash` Binary
`Sha256Hash` Binary
`Result` Int32
`USN` Int64
`Sha1CatalogHash` Binary
`Sha256CatalogHash` Binary
`UserWriteable` Boolean
`DetachedSignatureFilePathLength`
`DetachedSignatureFilePath`
`OriginalFileNameLength`
`OriginalFilename`
`InternalNameLength`
`InternalName`
`FileDescriptionLength`
`FileDescription`
`ProductNameLength`
`ProductName`
`FileVersionLength`
`FileVersion`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "event_source_name": "",
    "event_id": 8037,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-05T23:23:27.417018+00:00",
    "event_record_id": 212,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0000-B137-E1E43710DA01"
    },
    "execution": {
      "process_id": 4436,
      "thread_id": 4748
    },
    "channel": "Microsoft-Windows-AppLocker/MSI and Script",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "FilePathLength": 52,
    "FilePath": "C:\\Users\\User\\AppData\\Local\\Temp\\5727A9~1\\target.msi",
    "Sha1Hash": "BZ5vuVS8kFhj0G/vkELAqCSVqZQ=",
    "Sha256Hash": "V6OaWrftehYv3pf3Ok8wTra6kixgNW/+/Gv+5qiK/k4=",
    "Result": "",
    "USN": "p�t\u0010",
    "Sha1CatalogHash": "BZ5vuVS8kFhj0G/vkELAqCSVqZQ=",
    "Sha256CatalogHash": "vuwjuOrQZfho6c2gISZZmGl+eXBkI0qHyIi+luLHAGA=",
    "UserWriteable": true
  },
  "message": ""
}

References #

Microsoft Learn
Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 8038: Publisher info.

Channel: MSI and Script
Level: Informational

Message #

Publisher info:
Subject: %4
Issuer: %6
Signature index %2 (%1 total)

Fields #

Name	Description
`TotalSignatureCount` UInt32
`Signature` UInt32
`PublisherNameLength` UInt16
`PublisherName` UnicodeString
`IssuerNameLength` UInt16
`IssuerName` UnicodeString
`PublisherTBSHashSize` UInt32
`PublisherTBSHash` Binary
`IssuerTBSHashSize` UInt32
`IssuerTBSHash` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}",
    "event_source_name": "",
    "event_id": 8038,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-06T00:54:55.214842+00:00",
    "event_record_id": 242,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0001-6B7D-E5E43710DA01"
    },
    "execution": {
      "process_id": 12792,
      "thread_id": 6736
    },
    "channel": "Microsoft-Windows-AppLocker/MSI and Script",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Microsoft Learn
Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 8039: Package family name Version version GUID was allowed to install or update but would have been prevented if the Config CI policy.

Channel: MSI and Script

Description

Package family name Version version GUID was allowed to install or update but would have been prevented if the Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength) were enforced. Status PolicyID.

Message #

Package family name %2 version %3 was allowed to install or update but would have been prevented if the Config CI policy (Name:%5 ID:%7 Version:%8 GUID:%9) were enforced. Status %10

Fields #

Name	Description
`PackageFamilyNameLength` UInt16
`PackageFamilyName` UnicodeString
`PackageVersion` UInt64
`PolicyNameLength` UInt16
`PolicyName` UnicodeString
`PolicyIDLength` UInt16
`PolicyID` UnicodeString
`PolicyVersion` UInt64
`PolicyGuid` GUID
`Status` HexInt32	NTSTATUS reference

References #

Microsoft Learn

Event ID 8040: Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength).

Channel: MSI and Script
Collection Priority: Recommended (ASD)

Description

Package family name Version version GUID was prevented from installing or updating due to Config CI policy (Name:PackageFamilyName ID:PolicyNameLength Version:PolicyName GUID:PolicyIDLength). Status PolicyID.

Message #

Package family name %2 version %3 was prevented from installing or updating due to Config CI policy (Name:%5 ID:%7 Version:%8 GUID:%9). Status %10

Fields #

Name	Description
`PackageFamilyNameLength` UInt16
`PackageFamilyName` UnicodeString
`PackageVersion` UInt64
`PolicyNameLength` UInt16
`PolicyName` UnicodeString
`PolicyIDLength` UInt16
`PolicyID` UnicodeString
`PolicyVersion` UInt64
`PolicyGuid` GUID
`Status` HexInt32	NTSTATUS reference

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk # view in coverage

Windows AppLocker Block Events source: The following analytic detects attempts to bypass application restrictions by identifying Windows AppLocker policy violations. It leverages Windows AppLocker event logs, specifically EventCodes 8007, 8004, 8022, 8025, 8029, and 8040, to…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8007: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8025: PackageBuffer was prevented from running., Event ID 8022: PackageBuffer was prevented from running.
Windows AppLocker Privilege Escalation via Unauthorized Bypass source: The following analytic utilizes Windows AppLocker event logs to identify attempts to bypass application restrictions. AppLocker is a feature that allows administrators to specify which applications are permitted to run on a system. This…T1218↳ also matches Event ID 8004: FilePathBuffer was prevented from running., Event ID 8007: FilePathBuffer was prevented from running., Event ID 8029: FilePath was prevented from running due to Config CI policy., Event ID 8025: PackageBuffer was prevented from running., Event ID 8022: PackageBuffer was prevented from running.

References #

Microsoft Learn

Event ID 8041: A Subject was allowed to ExecutionDecision by system execution policy.

Channel: MSI and Script

Description

A Subject was allowed to ExecutionDecision by system execution policy. The application provided this information: 'AuditInfo'.

Message #

A %6 was allowed to %1 by system execution policy. The application provided this information: '%3'

Fields #

Name	Description
`ExecutionDecision` UInt32
`AuditInfoLength` UInt32
`AuditInfo` UnicodeString
`ExecutionOptionFlags` UInt32
`Host` GUID
`Subject` UInt32

Event ID 8042: A Subject was not allowed to be executed by system execution policy.

Channel: MSI and Script

Description

A Subject was not allowed to be executed by system execution policy. The application provided this information: 'AuditInfo'.

Message #

A %6 was not allowed to be executed by system execution policy. The application provided this information: '%3'

Fields #

Name	Description
`ExecutionDecision` UInt32
`AuditInfoLength` UInt32
`AuditInfo` UnicodeString
`ExecutionOptionFlags` UInt32
`Host` GUID
`Subject` UInt32

Event ID 8043: Process RegisterUninstallStringEventData.ProcessName attempted to register UninstallString RegisterUninstallStringEventData.UninstallString, Status: RegisterUninstallStringEventData.Status.

Channel: EXE and DLL
Level: Informational

Message #

Process %6 attempted to register UninstallString %2, Status: %9.

Fields #

Name	Description
`UninstallStringLength`
`UninstallString`
`UninstallerPathLength`
`UninstallerPath`
`ProcessNameLength`
`ProcessName`
`SessionId`
`SubSessionId`
`Status`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "event_source_name": "",
    "event_id": 8043,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:02:05.721093+00:00",
    "event_record_id": 43,
    "correlation": {},
    "execution": {
      "process_id": 12912,
      "thread_id": 13892
    },
    "channel": "Microsoft-Windows-AppLocker/EXE and DLL",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "user_data": {
    "RegisterUninstallStringEventData": {
      "UninstallStringLength": 43,
      "UninstallString": "\"C:\\Program Files\\TeamViewer\\uninstall.exe\"",
      "UninstallerPathLength": 53,
      "UninstallerPath": "\\DosDevices\\C:\\Program Files\\TeamViewer\\uninstall.exe",
      "ProcessNameLength": 78,
      "ProcessName": "\\Device\\HarddiskVolume4\\Users\\User\\AppData\\Local\\Temp\\CDD35C~1\\TeamViewer_.exe",
      "SessionId": "F205B252-1454-4144-BD5A-E00D8E398514",
      "SubSessionId": "0A236C0E-D7AD-508F-13CB-E8248F7D7476",
      "Status": 0
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 8044: Checking cmdline UninstallStringLength against registered UninstallStrings CmdlineLength, MatchFound: Cmdline, Status:MatchFound.

Channel: EXE and DLL

Message #

Checking cmdline %2 against registered UninstallStrings %4, MatchFound: %5, Status:%6.

Fields #

Name	Description
`UninstallStringLength` UInt16
`UninstallString` UnicodeString
`CmdlineLength` UInt16
`Cmdline` UnicodeString
`MatchFound` Boolean
`Status` HexInt32	NTSTATUS reference

Event ID 8045: Smart App Control Block Details

Channel: MSI and Script
Task: SmartAppControlBlockDetailsTask
Opcode: SmartAppControlBlockDetailsOp

Fields #

Name	Description
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString
`FileSha256Hash` Binary
`DefenderScanResultDetails` UInt32
`DefenderClientStatusCode` Int32
`DefenderCloudHTTPCode` HexInt32
`DefenderEngineReportGUID` GUID
`DefenderFlags` Int64
`DefenderCalled` UInt32
`DefenderCallAttempted` UInt32
`DefenderCloudCallRequested` UInt32
`DefenderMadeCloudCall` UInt32
`ExternalAuthorizationFlags` UInt32

Event ID 8045

Channel: Operational
Task: SmartAppControlBlockDetailsTask
Opcode: SmartAppControlBlockDetailsOp

Description

Smart App Control Block Details.

Fields #

Name	Description
`FilePathLength` UInt16
`FilePathBuffer` UnicodeString
`FileSha256Hash` Binary
`DefenderScanResultDetails` UInt32
`DefenderClientStatusCode` Int32
`DefenderCloudHTTPCode` HexInt32
`DefenderEngineReportGUID` GUID
`DefenderFlags` Int64
`DefenderCalled` UInt32
`DefenderCallAttempted` UInt32
`DefenderCloudCallRequested` UInt32
`DefenderMadeCloudCall` UInt32
`ExternalAuthorizationFlags` UInt32

Event ID 9000: The application setting with ID 'AppID' and name 'SettingName' was queried.

Channel: Verbose

Description

The application setting with ID 'AppID' and name 'SettingName' was queried. For more information, see the details tab.

Message #

The application setting with ID '%1' and name '%2' was queried. For more information, see the details tab.

Fields #

Name	Description
`AppID` UnicodeString
`SettingName` UnicodeString
`SettingType` UInt32
`ValueCount` UInt32
`Value` UnicodeString

Event ID 9001: The application setting with ID 'AppID' and name 'SettingName' was queried, and would have a different a value if all policies were enforcing.

Channel: Verbose

Description

The application setting with ID 'AppID' and name 'SettingName' was queried, and would have a different a value if all policies were enforcing. For more information, see the details tab.

Message #

The application setting with ID '%1' and name '%2' was queried, and would have a different a value if all policies were enforcing. For more information, see the details tab.

Fields #

Name	Description
`AppID` UnicodeString
`SettingName` UnicodeString
`SettingType` UInt32
`ValueCount` UInt32
`Value` UnicodeString
`AuditValueCount` UInt32
`AuditValue` UnicodeString

Provenance

ETW provider GUID {CBDA4DBF-8D5D-4F69-9578-BE14AA540D22}

Defined in srpapi.dll, which carries the event manifest.

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4647, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB