AppLocker Blocked File Execution
This rule detects when an application or file is prevented from running by AppLocker. It specifically looks for AppLocker event IDs 8004, 8007, 8022, and 8025, which indicate that an executable, script, or other file type was blocked from execution based on configured AppLocker policies. This is a critical control for preventing unauthorized software execution, especially in environments where users might attempt to run unapproved applications or scripts.
Sigma
