Rule Info
Name
PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy
Author
Tom3306
Description
Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
Date
2026-08-19 00:00:00
Modified
None
Id
f14b1e99-5e53-4598-98dc-6f20ad7b35e0
Tags
attack.discovery attack.t1518.001
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Tom3306
Merge PR #5887 from @Tom3306 - Add `PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy`
2026-08-19
Scan your endpoints, forensic images or collected files with our portable scanner THOR