8004 AppLocker log · EXE and DLL high severity low volume

AppLocker Event ID 8004 — AppLocker blocked a file (enforce)

Under AppLocker enforcement a file was prevented from running. Records the full file path, hash, publisher (Fqbn) and the target user.

Why event 8004 matters

A block is a strong signal: either a legitimate misconfiguration or an attacker's tool stopped from executing. Repeated 8004 from one user or host suggests attempted execution of disallowed tooling — often unsigned payloads in temp/AppData.

How to detect it

Alert on 8004 clusters. Capture file path, publisher and user. Prioritise blocked binaries in user-writable paths and known offensive tools. A single expected block plus many unexpected ones is the pattern to watch.

Log source
Microsoft-Windows-AppLocker/EXE and DLL
Configure AppLocker rules (Audit or Enforce) via GPO; events land in the AppLocker/EXE and DLL channel.
Fields to pivot on
FullFilePathFileHashFqbnTargetUser

MITRE ATT&CK mapping

Tactic Technique
Execution Malicious File (T1204.002)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: AppLocker Enforcement Block
status: stable
logsource:
  product: windows
  service: applocker
detection:
  sel:
    EventID: 8004
  condition: sel
level: high
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-AppLocker/EXE and DLL" and EventID == 8004   // AppLocker blocked a file (enforce)
// EventData holds: FullFilePath, FileHash, Fqbn, TargetUser
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" EventCode=8004
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# AppLocker blocked a file (enforce) — add EventData fields: FullFilePath, FileHash, Fqbn, TargetUser`
Hunt event 8004 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

References

Related EXE and DLL events

8003 AppLocker would have blocked a file (audit)

Frequently asked questions

What is AppLocker Event ID 8004?

AppLocker blocked a file (enforce). Under AppLocker enforcement a file was prevented from running. Records the full file path, hash, publisher (Fqbn) and the target user.

Which log records event 8004?

Event 8004 is written to the Microsoft-Windows-AppLocker/EXE and DLL channel by Microsoft-Windows-AppLocker. Configure AppLocker rules (Audit or Enforce) via GPO; events land in the AppLocker/EXE and DLL channel.

What MITRE ATT&CK techniques map to event 8004?

Event 8004 is associated with: Malicious File (T1204.002).

How do you detect activity around event 8004?

Alert on 8004 clusters. Capture file path, publisher and user. Prioritise blocked binaries in user-writable paths and known offensive tools. A single expected block plus many unexpected ones is the pattern to watch.