PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy

SigmaHQ Detections@sigmaHQ

•updated Aug 18, 2026•3•0•25

Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.