Skip to content
Threat Feed
Subscribe

Tag

Applocker

4 briefs RSS
medium advisory

AppLocker Audit Events Indicate Potential Policy Violations

This brief describes the detection of Windows AppLocker audit events (Event IDs 8003, 8006, 8021, 8024) that indicate applications, DLLs, scripts, MSIs, or packaged apps would have been blocked by an active AppLocker policy, providing insight into unauthorized software execution attempts or policy violations in audit mode.

AppLocker audit windows-security application-control
1r 6t
high threat

Detect PowerShell AppLocker Policy Import Activity

Detection of PowerShell commands to import AppLocker policy via Import-Module Applocker and Set-AppLockerPolicy, potentially used to enforce restrictive policies or disable security products like antivirus.

Splunk Enterprise +2 Azorult applocker powershell defense-evasion endpoint
2r 1t
high advisory

Suspicious AppLocker XML Policy Import via PowerShell

Detection of PowerShell commands used to import AppLocker XML policies, potentially indicating an attempt to bypass security controls, as observed with Azorult malware.

Splunk Enterprise +2 applocker defense-evasion powershell
2r
high advisory

AppLocker Registry Modification to Deny Security Software Execution

Attackers can modify the Windows registry via AppLocker to block the execution of security software, potentially disabling defenses and allowing further malicious activities.

Splunk Enterprise +2 applocker defense-evasion registry-modification
2r