detection.wiki

Microsoft-Windows-AppLocker › Event 8037

Event ID 8037 — FilePath passed Config CI policy and was allowed to run.

Provider
Microsoft-Windows-AppLocker
Channel
MSI and Script
Level
Informational

Description

FilePath passed Config CI policy and was allowed to run.

Message #

%2 passed Config CI policy and was allowed to run.

Fields #

NameDescription
FilePathLength UInt16—
FilePath UnicodeString—
Sha1Hash Binary—
Sha256Hash Binary—
Result Int32—
USN Int64—
Sha1CatalogHash Binary—
Sha256CatalogHash Binary—
UserWriteable Boolean—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppLocker",
    "guid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22",
    "event_source_name": "",
    "event_id": 8037,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-05T23:23:27.417018+00:00",
    "event_record_id": 212,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0000-B137-E1E43710DA01"
    },
    "execution": {
      "process_id": 4436,
      "thread_id": 4748
    },
    "channel": "Microsoft-Windows-AppLocker/MSI and Script",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "FilePathLength": 52,
    "FilePath": "C:\\Users\\User\\AppData\\Local\\Temp\\5727A9~1\\target.msi",
    "Sha1Hash": "BZ5vuVS8kFhj0G/vkELAqCSVqZQ=",
    "Sha256Hash": "V6OaWrftehYv3pf3Ok8wTra6kixgNW/+/Gv+5qiK/k4=",
    "Result": "",
    "USN": "p�t\u0010",
    "Sha1CatalogHash": "BZ5vuVS8kFhj0G/vkELAqCSVqZQ=",
    "Sha256CatalogHash": "vuwjuOrQZfho6c2gISZZmGl+eXBkI0qHyIi+luLHAGA=",
    "UserWriteable": true
  },
  "message": ""
}

References #