PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy

Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.

title: PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy
id: f14b1e99-5e53-4598-98dc-6f20ad7b35e0
status: experimental
description: |
    Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
references:
    - https://learn.microsoft.com/en-us/powershell/module/applocker/get-applockerpolicy
author: Tom3306
date: 2026-08-19
tags:
    - attack.discovery
    - attack.t1518.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cmdlet:
        CommandLine|contains: 'Get-AppLockerPolicy'
    selection_flag:
        CommandLine|contains|windash:
            - ' -Effective'
            - ' -Ldap '
            - ' -Local'
    condition: all of selection_*
falsepositives:
    - PowerShell-based AppLocker auditing and policy troubleshooting by administrators.
level: low

• T1518.001Security Software Discovery

• https://learn.microsoft.com/en-us/powershell/module/applocker/get-applockerpolicy↗