Windows AppLocker Unauthorized Bypass Attempts

The analytic identifies attempts to bypass AppLocker application restrictions by monitoring specific Windows AppLocker event codes (8007, 8004, 8022, 8025, 8029, 8040). These event codes indicate block events where an application was prevented from running due to AppLocker policies. The rule focuses on instances where five or more such attempts occur from the same source, which could suggest an attacker trying to escalate privileges or execute unauthorized code on the system. It extracts details such as the host, full file path, and target user associated with the bypass attempt.