Skip to content

Instantly share code, notes, and snippets.

@p0w3rsh3ll

p0w3rsh3ll/filter-constrained-lang-mode-noise-from-Applocker-eventlog.ps1 Secret

Created April 11, 2018 14:55
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save p0w3rsh3ll/d93044b3c5d9b98ffc1e628280c8c131 to your computer and use it in GitHub Desktop.
Save p0w3rsh3ll/d93044b3c5d9b98ffc1e628280c8c131 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
filter-constrained-lang-mode-noise-from-Applocker-eventlog.ps1
Get-WinEvent -FilterXml @'
<QueryList>
<Query Id="0" Path="Microsoft-Windows-AppLocker/MSI and Script">
<Select Path="Microsoft-Windows-AppLocker/MSI and Script">
*[System[(EventID=8007)]]
and
*[UserData[RuleAndFileData[(FileHash!="6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B")]]]
</Select>
</Query>
</QueryList>
'@ -MaxEvents 1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment