DFIRHub

Windows event log ยท Microsoft-Windows-AppLocker/EXE and DLL8002 An executable was allowed to run

  • Defender and policy
  • 6 fields
  • Microsoft-Windows-AppLocker%4EXE and DLL.evtx
  • Microsoft-Windows-AppLocker

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • ExecutableInfo%FilePath%
    • %FilePath% = /Event/UserData/RuleAndFileData/FilePath
  • PayloadData1%FileHash%
    • %FileHash% = /Event/UserData/RuleAndFileData/FileHash
  • PayloadData2%Fqbn%
    • %Fqbn% = /Event/UserData/RuleAndFileData/Fqbn
  • PayloadData3TargetUser
    • %TargetUser% = /Event/UserData/RuleAndFileData/TargetUser
  • PayloadData4%TargetLogonId%
    • %TargetLogonId% = /Event/UserData/RuleAndFileData/TargetLogonId
  • PayloadData5%FullFilePath%
    • %FullFilePath% = /Event/UserData/RuleAndFileData/FullFilePath

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-AppLocker" Guid="xxxxxxxxxxxxxxx"/>
    <EventID>8002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-11-07 22:15:09.5660628"/>
    <EventRecordID>69257</EventRecordID>
    <Correlation/>
    <Execution ProcessID="2968" ThreadID="4456"/>
    <Channel>Microsoft-Windows-AppLocker/EXE and DLL</Channel>
    <Computer>xxxxxxxxxxx</Computer>
    <Security UserID="xxxxxxxxxxxxxxx"/>
  </System>
  <UserData>
    <RuleAndFileData>
      <PolicyNameLength>3</PolicyNameLength>
      <PolicyName>EXE</PolicyName>
      <RuleId>4bad95f0-8229-4341-8515-a693d3506806</RuleId>
      <RuleNameLength>24</RuleNameLength>
      <RuleName>(Default Rule) All Exe's</RuleName>
      <RuleSddlLength>48</RuleSddlLength>
      <RuleSddl>D:(XA;;FX;;;S-1-1-0;(APPID://PATH Contains "*"))</RuleSddl>
      <TargetUser>xxxxxx</TargetUser>
      <TargetProcessId>6348</TargetProcessId>
      <FilePathLength>22</FilePathLength>
      <FilePath>%SYSTEM32%\RDPCLIP.EXE</FilePath>
      <FileHashLength>32</FileHashLength>
      <FileHash>10-67-8D-A8-38-A4-B1-65-60-61-15-36-79-FD-C4-41-3B-26-C4-D5-ED-F2-C1-3A-B7-66-1B-EB-4E-ED-60-81</FileHash>
      <FqbnLength>118</FqbnLength>
      <Fqbn>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT WINDOWS OPERATING SYSTEM\RDPCLIP.EXE\6.3.9600.19393</Fqbn>
    </RuleAndFileData>
  </UserData>
</Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-AppLocker-EXE-and-DLL_Microsoft-Windows-AppLocker_8002.map(opens in new tab) by Phill Moore and contributors(opens in new tab), MIT License(opens in new tab)