
title: File Was Not Allowed To Run
author: Pushkarev Dmitry
date: 2020/06/28
description: Detect run not allowed files. Applocker is a very useful tool, especially
  on servers where unprivileged users have access. For example terminal servers. You
  need configure applocker and log collect to receive these events.
detection:
  SELECTION_1:
    EventID: 8004
  SELECTION_2:
    EventID: 8007
  condition: (SELECTION_1 or SELECTION_2)
falsepositives:
- need tuning applocker or add exceptions in SIEM
fields:
- PolicyName
- RuleId
- RuleName
- TargetUser
- TargetProcessId
- FilePath
- FileHash
- Fqbn
id: 401e5d00-b944-11ea-8f9a-00163ecd60ae
level: medium
logsource:
  product: windows
  service: applocker
modified: 2020/08/23
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker
- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker
- https://nxlog.co/documentation/nxlog-user-guide/applocker.html
status: experimental
tags:
- attack.execution
- attack.t1086
- attack.t1064
- attack.t1204
- attack.t1035
- attack.t1204.002
- attack.t1059.001
- attack.t1059.003
- attack.t1059.005
- attack.t1059.006
- attack.t1059.007
ruletype: SIGMA
