Sigma Rules

PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy

Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.