Detection rules › By event

Microsoft-Windows-AppLocker

Event	Rules
Event ID 8002	3
Event ID 8003	3
Event ID 8004	3
Event ID 8005	7
Event ID 8006	1
Event ID 8007	3
Event ID 8021	1
Event ID 8022	3
Event ID 8024	1
Event ID 8025	3
Event ID 8029	2
Event ID 8040	2

Event ID 8002

3 detection rules reference this event. View event page.

Sigma (1)

NTLM Logon severity low T1550, T1550.002

Kusto (2)

TI Map File Hash to Security Event severity medium T1071
TI map File Hash to Security Event severity medium T1071

Event ID 8003

3 detection rules reference this event. View event page.

Sigma (1)

AppLocker Application Would Have Been Blocked severity medium T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007

Kusto (2)

TI Map File Hash to Security Event severity medium T1071
TI map File Hash to Security Event severity medium T1071

Event ID 8004

3 detection rules reference this event. View event page.

Sigma (1)

AppLocker Prevented Application or Script from Running severity medium T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007

Splunk (2)

Windows AppLocker Block Events severity low T1218
Windows AppLocker Privilege Escalation via Unauthorized Bypass severity medium T1218

Event ID 8005

7 detection rules reference this event. View event page.

Splunk (5)

Windows Multiple NTLM Null Domain Authentications severity medium T1110, T1110.003
Windows Unusual NTLM Authentication Destinations By Source severity low T1110, T1110.003
Windows Unusual NTLM Authentication Destinations By User severity low T1110, T1110.003
Windows Unusual NTLM Authentication Users By Destination severity low T1110, T1110.003
Windows Unusual NTLM Authentication Users By Source severity low T1110, T1110.003

Kusto (2)

TI Map File Hash to Security Event severity medium T1071
TI map File Hash to Security Event severity medium T1071

Event ID 8006

1 detection rules reference this event. View event page.

Sigma (1)

AppLocker Application Would Have Been Blocked severity medium T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007

Event ID 8007

3 detection rules reference this event. View event page.

Sigma (1)

AppLocker Prevented Application or Script from Running severity medium T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007

Splunk (2)

Windows AppLocker Block Events severity low T1218
Windows AppLocker Privilege Escalation via Unauthorized Bypass severity medium T1218

Event ID 8021

1 detection rules reference this event. View event page.

Sigma (1)

AppLocker Application Would Have Been Blocked severity medium T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007

Event ID 8022

3 detection rules reference this event. View event page.

Sigma (1)

AppLocker Prevented Application or Script from Running severity medium T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007

Splunk (2)

Windows AppLocker Block Events severity low T1218
Windows AppLocker Privilege Escalation via Unauthorized Bypass severity medium T1218

Event ID 8024

1 detection rules reference this event. View event page.

Sigma (1)

AppLocker Application Would Have Been Blocked severity medium T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007

Event ID 8025

3 detection rules reference this event. View event page.

Sigma (1)

AppLocker Prevented Application or Script from Running severity medium T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007

Splunk (2)

Windows AppLocker Block Events severity low T1218
Windows AppLocker Privilege Escalation via Unauthorized Bypass severity medium T1218

Event ID 8029

2 detection rules reference this event. View event page.

Splunk (2)

Windows AppLocker Block Events severity low T1218
Windows AppLocker Privilege Escalation via Unauthorized Bypass severity medium T1218

Event ID 8040

2 detection rules reference this event. View event page.

Splunk (2)

Windows AppLocker Block Events severity low T1218
Windows AppLocker Privilege Escalation via Unauthorized Bypass severity medium T1218