AppLocker Event ID 8003 — AppLocker would have blocked a file (audit)

Under AppLocker audit mode a file was allowed to run but would be blocked under enforcement. Records the full file path, hash and publisher (Fqbn) and the target user.

Why event 8003 matters

In audit mode 8003 reveals exactly what enforcement would stop — unsigned binaries from user paths, and living-off-the-land binaries (LOLBins). It is the primary tuning signal before turning on enforcement and a good hunt surface for execution from unusual locations.

How to detect it

Hunt 8003 for binaries in user-writable directories (AppData, Temp, Downloads), unsigned files, and known LOLBins (rundll32, regsvr32, mshta). Cluster by host/user to find execution attempts.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

title: AppLocker Audit — File Would Be Blocked
status: experimental
logsource:
  product: windows
  service: applocker
detection:
  sel:
    EventID: 8003
  condition: sel
level: medium

Event
| where EventLog == "Microsoft-Windows-AppLocker/EXE and DLL" and EventID == 8003   // AppLocker would have blocked a file (audit)
// EventData holds: FullFilePath, FileHash, Fqbn, TargetUser
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" EventCode=8003
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# AppLocker would have blocked a file (audit) — add EventData fields: FullFilePath, FileHash, Fqbn, TargetUser`

References

• learn.microsoft.com

Related EXE and DLL events