Skip to content
Threat Feed
Subscribe

Tag

Application-Control

2 briefs RSS
medium advisory

AppLocker Audit Events Indicate Potential Policy Violations

This brief describes the detection of Windows AppLocker audit events (Event IDs 8003, 8006, 8021, 8024) that indicate applications, DLLs, scripts, MSIs, or packaged apps would have been blocked by an active AppLocker policy, providing insight into unauthorized software execution attempts or policy violations in audit mode.

AppLocker audit windows-security application-control
1r 6t
medium advisory

Potentially Suspicious WDAC Policy File Creation

Attackers may create Windows Defender Application Control (WDAC) policy files from abnormal processes to bypass Endpoint Detection and Response (EDR) or Antivirus (AV) solutions while allowing their own malicious code to execute on compromised Windows systems, impacting defense capabilities.

defense-impairment wdac application-control windows
1r 1t