Skip to content
This repository has been archived by the owner on Apr 14, 2023. It is now read-only.

AppLocker event descriptions inaccurate #19

Open
IAmAnthem opened this issue Aug 28, 2020 · 0 comments
Open

AppLocker event descriptions inaccurate #19

IAmAnthem opened this issue Aug 28, 2020 · 0 comments

Comments

@IAmAnthem
Copy link

IAmAnthem commented Aug 28, 2020

8002,8003,8004 are not described correctly in the RecommendedEvents files.

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker

8002 - allowed to run
8003 - would be blocked if enforcement was on
8004 - was blocked

8006 Would be blocked if Enforcement On Microsoft-Windows-AppLocker/MSI and Script
8007 Was Blocked Warning Microsoft-Windows-AppLocker/MSI and Script

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant