GitHub Repo

Detection: Windows Powershell Import Applocker Policy

Updated Date: 2026-06-29 ID: 102af98d-0ca3-4aa4-98d6-7ab2b98b955a Author: Teoderick Contreras, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects the import of Windows PowerShell Applocker cmdlets, specifically identifying the use of "Import-Module Applocker" and "Set-AppLockerPolicy" with an XML policy. It leverages PowerShell Script Block Logging (EventCode 4104) to capture and analyze script block text. This activity is significant as it may indicate an attempt to enforce restrictive Applocker policies, potentially used by malware like Azorult to disable antivirus products. If confirmed malicious, this could allow an attacker to bypass security controls, leading to further system compromise and persistence.

 1`powershell`
 2EventCode=4104
 3ScriptBlockText="*Import-Module Applocker*"
 4ScriptBlockText="*Set-AppLockerPolicy*"
 5ScriptBlockText="* -XMLPolicy *"
 6
 7| fillnull
 8
 9| stats count min(_time) as firstTime
10              max(_time) as lastTime
11  by dest signature signature_id
12     user_id vendor_product EventID
13     Guid Opcode Name
14     Path ProcessID ScriptBlockId
15     ScriptBlockText
16
17| `security_content_ctime(firstTime)`
18
19| `security_content_ctime(lastTime)`
20
21| `windows_powershell_import_applocker_policy_filter`

Data Source

Name Platform Sourcetype Source
Powershell Script Block Logging 4104 Windows icon Windows 'XmlWinEventLog' 'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
windows_powershell_import_applocker_policy_filter search *
windows_powershell_import_applocker_policy_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1059.001 PowerShell Execution
T1685 Disable or Modify Tools Defense Impairment
Exploitation
Installation
DE.AE
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Finding (Notable) No
Creates Intermediate Finding (Risk Event) Yes
Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.

Known False Positives

administrators may execute this command that may cause some false positive.

Associated Analytic Story

Intermediate Findings

Message Entity Field Entity Type Risk Score
A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Import-Module Applocker and Set-AppLockerPolicy commands to import Applocker policy was executed on host $dest$ by user $user_id$ user_id user 20
A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Import-Module Applocker and Set-AppLockerPolicy commands to import Applocker policy was executed on host $dest$ dest system 20

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-PowerShell/Operational XmlWinEventLog
Integration ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-PowerShell/Operational XmlWinEventLog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 14