Restricted Software Access By SRP
This rule detects when the Windows Software Restriction Policies (SRP) prevent an application from executing. This can indicate an attempt to run unauthorized software that is blocked by administrative policies, potentially signaling a policy violation, malware execution attempt, or an adversary attempting to bypass security controls. The rule specifically looks for Event IDs 865, 866, 867, and 868 from the 'Microsoft-Windows-SoftwareRestrictionPolicies' provider, which correspond to different reasons for access restriction (default policy, location-based rule, publisher policy, or general policy rule).
Sigma
