Restricted Software Access By SRP

Severity: high
Author: frack113
Source: upstream

Detects restricted access to applications by the Software Restriction Policies (SRP) policy

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1072` Software Deployment Tools
Lateral Movement	`T1072` Software Deployment Tools

Event coverage

Provider	Event ID	Title
SoftwareRestrictionPolicies	865	Access to AttemptedPath has been restricted by your Administrator by the default software restriction policy level.
SoftwareRestrictionPolicies	866	Access to AttemptedPath has been restricted by your Administrator by location with policy rule SrpRuleGuid placed on path RulePath.
SoftwareRestrictionPolicies	867	Access to AttemptedPath has been restricted by your Administrator by software publisher policy.
SoftwareRestrictionPolicies	868	Access to AttemptedPath has been restricted by your Administrator by policy rule SrpRuleGuid.
SoftwareRestrictionPolicies	882	Access to AttemptedPath has been restricted by your Administrator by policy rule SrpRuleGuid.

Stages and Predicates

Stage 1: `selection`

Provider_Name: 'Microsoft-Windows-SoftwareRestrictionPolicies'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.