Skip to content
Sign In
Telemetry

win:applocker 8004

AppLocker Block

Log source
AppLocker logs
Host type
Windows (workstation, member server, domain controller)
Tier, host type
Recommended
Techniques
0
Rules depending on it
Sigma 1

Why this tier

NSA

By role

RoleTierBasis
Windows workstationRecommendedNSA
Windows member serverRecommendedNSA
Windows domain controllerRecommendedNSA
Windows web server (IIS), internet-facingRecommendedNSA

Techniques it helps detect

No ATT&CK analytic names this event. Its standing comes from the standards and rules below.

Rules that depend on it

Sigma 1

Standards and guidance naming it

RequirementRelationBasis
NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv)Names this eventApplication Whitelisting: AppLocker Block

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.