Message

AppID policy conversion failed. Status %1.

Fields

Message

The AppLocker policy was applied successfully to this computer.

Example Event

system:
  provider: Microsoft-Windows-AppLocker
  guid: CBDA4DBF-8D5D-4F69-9578-BE14AA540D22
  event_source_name: ''
  event_id: 8001
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-05T23:50:01.740733+00:00'
  event_record_id: 39
  correlation: {}
  execution:
    process_id: 4372
    thread_id: 9624
  channel: Microsoft-Windows-AppLocker/EXE and DLL
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data: {}
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

%11 was allowed to run.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

%11 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/using-event-viewer-with-applocker

Message

%11 was prevented from running.

Fields

Sigma Rules

• AppLocker Prevented Application or Script from Running
  Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/using-event-viewer-with-applocker

Message

%11 was allowed to run.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/using-event-viewer-with-applocker

Message

%11 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/using-event-viewer-with-applocker

Message

%11 was prevented from running.

Fields

Sigma Rules

• AppLocker Prevented Application or Script from Running
  Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/using-event-viewer-with-applocker

Message

%2: AppLocker component not available on this SKU.

Fields

Message

%2: AppLocker component not available on this SKU.

Fields

Message

%11 was allowed to run.

Fields

Message

%11 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Fields

Message

%11 was prevented from running.

Fields

Sigma Rules

• AppLocker Prevented Application or Script from Running
  Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Message

%11 was allowed to be installed.

Fields

Message

%11 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.

Fields

Message

%11 was prevented from running.

Fields

Sigma Rules

• AppLocker Prevented Application or Script from Running
  Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Message

No packaged apps can be executed while Exe rules are being enforced and no Packaged app rules have been configured.

Message

No packaged apps can be executed while Exe rules are being enforced and no Packaged app rules have been configured.

Message

%2 was allowed to run but would have been prevented if the Config CI policy were enforced.

Fields

Example Event

system:
  provider: Microsoft-Windows-AppLocker
  guid: CBDA4DBF-8D5D-4F69-9578-BE14AA540D22
  event_source_name: ''
  event_id: 8028
  version: 0
  level: 3
  task: 0
  opcode: 0
  keywords: 4611686018427387904
  time_created: '2023-11-06T00:54:55.214802+00:00'
  event_record_id: 241
  correlation:
    ActivityID: E4DB489E-1037-0001-6B7D-E5E43710DA01
  execution:
    process_id: 12792
    thread_id: 6736
  channel: Microsoft-Windows-AppLocker/MSI and Script
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  FilePathLength: 70
  FilePath: C:\Windows\Installer\{6F11CAC3-D33D-4360-B139-73F3276A2B9A}\loc.en.mst
  Sha1Hash: C9FD8657FD8262EF19369B5FB6CAA7CB7632FC87
  Sha256Hash: 3881BD701A2B9DE71742065AADC110FBFFD17F127785FDA4E17570A77FC3FA84
  Result: -790036478
  USN: 309169000
  Sha1CatalogHash: C9FD8657FD8262EF19369B5FB6CAA7CB7632FC87
  Sha256CatalogHash: 9A71D576BC994B8C6DCFA683B38313596DCE7774784D46EFC5FE5D97724043BC
  UserWriteable: false
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

%2 was prevented from running due to Config CI policy.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

ManagedInstaller check SUCCEEDED during Appid verification of
%2.
Status: %5

Fields

Message

SmartlockerFilter detected file %2 being written by process %4.

Fields

Message

ManagedInstaller check FAILED during Appid verification of
%2.
Status: %5

Fields

Message

ManagedInstaller check FAILED during Appid verification of
%2.
Status: %5
Allowed to run due to Audit Applocker Policy

Fields

Message

ManagedInstaller Script check FAILED during Appid verification of
%2.
Status: %3

Fields

Message

ManagedInstaller Script check SUCCEEDED during Appid verification of
%2.
Status: %3

Fields

Message

%2 was prevented from running due to Config CI policy.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

%2 passed Config CI policy and was allowed to run.

Fields

Example Event

system:
  provider: Microsoft-Windows-AppLocker
  guid: CBDA4DBF-8D5D-4F69-9578-BE14AA540D22
  event_source_name: ''
  event_id: 8037
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 4611686018427387904
  time_created: '2023-11-05T23:23:27.417018+00:00'
  event_record_id: 212
  correlation:
    ActivityID: E4DB489E-1037-0000-B137-E1E43710DA01
  execution:
    process_id: 4436
    thread_id: 4748
  channel: Microsoft-Windows-AppLocker/MSI and Script
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
  FilePathLength: 52
  FilePath: C:\Users\User\AppData\Local\Temp\5727A9~1\target.msi
  Sha1Hash: BZ5vuVS8kFhj0G/vkELAqCSVqZQ=
  Sha256Hash: V6OaWrftehYv3pf3Ok8wTra6kixgNW/+/Gv+5qiK/k4=
  Result: ''
  USN: "p�t\x10"
  Sha1CatalogHash: BZ5vuVS8kFhj0G/vkELAqCSVqZQ=
  Sha256CatalogHash: vuwjuOrQZfho6c2gISZZmGl+eXBkI0qHyIi+luLHAGA=
  UserWriteable: true
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Publisher info:
Subject: %4
Issuer: %6
Signature index %2 (%1 total)

Fields

Example Event

system:
  provider: Microsoft-Windows-AppLocker
  guid: '{cbda4dbf-8d5d-4f69-9578-be14aa540d22}'
  event_source_name: ''
  event_id: 8038
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 4611686018427387904
  time_created: '2023-11-06T00:54:55.214842+00:00'
  event_record_id: 242
  correlation:
    ActivityID: E4DB489E-1037-0001-6B7D-E5E43710DA01
  execution:
    process_id: 12792
    thread_id: 6736
  channel: Microsoft-Windows-AppLocker/MSI and Script
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data: {}
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Package family name %2 version %3 was allowed to install or update but would have been prevented if the Config CI policy (Name:%5 ID:%7 Version:%8 GUID:%9) were enforced. Status %10

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

Package family name %2 version %3 was prevented from installing or updating due to Config CI policy (Name:%5 ID:%7 Version:%8 GUID:%9). Status %10

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Message

A %6 was allowed to %1 by system execution policy. The application provided this information: '%3'

Fields

Message

A %6 was not allowed to be executed by system execution policy. The application provided this information: '%3'

Fields

Message

Process %6 attempted to register UninstallString %2, Status: %9.

Fields

Example Event

system:
  provider: Microsoft-Windows-AppLocker
  guid: CBDA4DBF-8D5D-4F69-9578-BE14AA540D22
  event_source_name: ''
  event_id: 8043
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9223372036854775808
  time_created: '2023-11-06T01:02:05.721093+00:00'
  event_record_id: 43
  correlation: {}
  execution:
    process_id: 12912
    thread_id: 13892
  channel: Microsoft-Windows-AppLocker/EXE and DLL
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-21-1992711665-1655669231-58201500-1000
user_data:
  RegisterUninstallStringEventData:
    UninstallStringLength: 43
    UninstallString: '"C:\Program Files\TeamViewer\uninstall.exe"'
    UninstallerPathLength: 53
    UninstallerPath: \DosDevices\C:\Program Files\TeamViewer\uninstall.exe
    ProcessNameLength: 78
    ProcessName: \Device\HarddiskVolume4\Users\User\AppData\Local\Temp\CDD35C~1\TeamViewer_.exe
    SessionId: F205B252-1454-4144-BD5A-E00D8E398514
    SubSessionId: 0A236C0E-D7AD-508F-13CB-E8248F7D7476
    Status: 0
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Checking cmdline %2 against registered UninstallStrings %4, MatchFound: %5, Status:%6.

Fields

Fields

Message

Smart App Control Block Details

Fields

Message

The application setting with ID '%1' and name '%2' was queried. For more information, see the details tab.

Fields

Message

The application setting with ID '%1' and name '%2' was queried, and would have a different a value if all policies were enforcing. For more information, see the details tab.

Fields