Skip to content
Sign In
Telemetry

win:applocker

AppLocker logs

Channels: Microsoft-Windows-AppLocker/EXE and DLL, MSI and Script, Packaged app-*

Host type
Windows (workstation, member server, domain controller)
Cost class
Included
Techniques
1
Rules listed
2
Events
12

Licensing

License or service
Windows OS
What is free
CodeIntegrity/Operational 3076-3077; AppLocker MSI and Script 8028-8040
What costs
Nothing
Notes
Edition applicability (Pro vs Enterprise) not stated on page
Vendor page
https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations
As read on
2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

Standards and guidance naming this source

RequirementRelationBasis
OMB M-26-14: Security tooling alertsSupports an activityour analysis: blocked executions

Techniques

Rules

Sigma 2

Events

Recommended (8)

  • 8002AppLocker Block
  • 8003AppLocker Block
  • 8004AppLocker Block
  • 8005Script or Installer ran
  • 8006AppLocker Warning
  • 8007AppLocker Warning
  • 8020Application Ran
  • 8023Application Installed

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.