Potential AppLocker File Tampering
The rule detects object access events (Event ID 4663) targeting files within the \Windows\System32\AppLocker directory. This identifies unauthorized attempts to read, write, or delete the system's application control policy cache, a behavior indicative of an attempt to tamper with endpoint security defenses.
Splunk (SPL)
