# Get-AppLockerEventlog | Script For Fetching Applocker Event Log By Parsing The Win-Event Log

**URL:** <https://onehack.st/t/get-applockereventlog-script-for-fetching-applocker-event-log-by-parsing-the-win-event-log/231969>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, freebies\
**Created:** [February 22, 2023, 9:41pm UTC](https://onehack.st/t/get-applockereventlog-script-for-fetching-applocker-event-log-by-parsing-the-win-event-log/231969 "2023-02-22T21:41:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [February 22, 2023, 9:41pm UTC](https://onehack.st/t/get-applockereventlog-script-for-fetching-applocker-event-log-by-parsing-the-win-event-log/231969/1 "2023-02-22T21:41:00Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/d/d/dd31f6fa3f9819545ebc405196f527beeec2fe15.jpeg)

# Get-AppLockerEventlog

## DESCRIPTION

This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order to troubleshoot. Here are the logs we fetch from win-event:

- EXE and DLL,
- MSI and Script,
- Packaged app-Deployment,
- Packaged app-Execution.

### The output:

- The result will be displayed on the screen  
[![all](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/raw/main/Images/All-1.png)](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/blob/main/Images/All-1.png)
- And, The result will be saved to a csv file: **AppLocker-log.csv**

[![csv](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/raw/main/Images/csv.png)](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/blob/main/Images/csv.png)

The juicy and useful information you will get with this script are:

- FileType,
- EventID,
- Message,
- User,
- Computer,
- EventTime,
- FilePath,
- Publisher,
- FileHash,
- Package
- RuleName,
- LogName,
- TargetUser.

## PARAMETERS

### HunType

This parameter specifies the type of events you are interested in, there are 04 values for this parameter:

**1. All**

This gets all the events of AppLocker that are interesting for threat-hunting, forensic or even troubleshooting. This is the default value.

```auto
.\Get-AppLockerEventlog.ps1 -HunType All

```

[![all](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/raw/main/Images/All-2.png)](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/blob/main/Images/All-2.png)

**2. Block**

This gets all the events that are triggered by the action of blocking an application by AppLocker, this type is critical for threat-hunting or forensics, and comes with high priority, since it indicates malicious attempts, or could be a good indicator of prior malicious activity in order to evade defensive mechanisms.

```auto
.\Get-AppLockerEventlog.ps1 -HunType Block |Format-Table -AutoSize

```

[![Block](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/raw/main/Images/Block-1.png)](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/blob/main/Images/Block-1.png)

**3. Allow**

This gets all the events that are triggered by the action of Allowing an application by AppLocker. For threat-hunting or forensics, even the allowed applications should be monitored, in order to detect any possible bypass or configuration mistakes.

```auto
.\Get-AppLockerEventlog.ps1 -HunType Allow | Format-Table -AutoSize

```

[![Allow](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/raw/main/Images/Allow-1.png)](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog/blob/main/Images/Allow-1.png)

**4. Audit**

This gets all the events generated when AppLocker would block the application if the enforcement mode were enabled (Audit mode). For threat-hunting or forensics, this could indicate any configuration mistake, neglect from the admin to switch the mode, or even a malicious action that happened in the audit phase (tuning phase).

```auto
 .\Get-AppLockerEventlog.ps1 -HunType Audit
 

```

## Resource

To better understand AppLocker :

- [Diving in AppLocker for Blue Team — Part 1](https://medium.com/@elromaissa2/diving-in-applocker-for-blue-team-57a7328ce5c0)
- [https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker)

## Contributing

This project welcomes contributions and suggestions.

## GitHub:

> **[GitHub - RomaissaAdjailia/Get-AppLockerEventlog: This is a repo for fetching Applocker event log by...](https://github.com/RomaissaAdjailia/Get-AppLockerEventlog)**
>
> This is a repo for fetching Applocker event log by parsing the win-event log