PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy

Title: PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy
Status: experimental
Description:Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
References:
  -https://learn.microsoft.com/en-us/powershell/module/applocker/get-applockerpolicy
Author: Tom3306
Date: 2026-08-19
modified:None
Tags:

• -'attack.discovery'
• -'attack.t1518.001'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
    - Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    - OriginalFileName:
      - 'PowerShell.EXE'
      - 'pwsh.dll'
  selection_cmdlet:
    CommandLine|contains: 'Get-AppLockerPolicy'
  selection_flag:
    CommandLine|contains|windash:
      -' -Effective'
      -' -Ldap '
      -' -Local'

  condition:all of selection_*
Falsepositives:
  -PowerShell-based AppLocker auditing and policy troubleshooting by administrators.
Level: low