powershell get-winevent how to get only path and exe file? - powershell

Question

How to get from applocker winevent only path of file and name of file (file.exe), i mean how to filter this info
Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL"

Answer 1

Have a look at the below, to see if this helps your use case. I too, don't have this on a system I can test at this point.
<#
Pull all AppLocker logs from the live AppLocker event log
(requires Applocker)
#>
Get-WinEvent -logname "Microsoft-Windows-AppLocker/EXE and DLL"
<#
Search for live AppLocker EXE/MSI block events: "(EXE) was prevented
from running":
#>
Get-WinEvent -FilterHashtable #{
logname = 'MicrosoftWindows-Applocker/EXE and DLL'
id = 8004
}
<#
Search for live AppLocker EXE/MSI audit events: "(EXE) was allowed
to run but would have been prevented from running if the AppLocker
the policy was enforced":
#>
Get-WinEvent -FilterHashtable #{
logname = 'MicrosoftWindows-Applocker/EXE and DLL'
id = 8003
}
Get-AppLockerEvent - Get event details related to AppLocker
activity
AppLocker events include a number of helpful details that are buried
within the event object or XML. This function will extract helpful
information like the username, rule name, file path, file hash, and
file signature details for easy viewing.
Download: Get-AppLockerEvent.ps1

Answer 2

That log is empty on my machine, but maybe you can do something with the xml from the event:
[xml]$xml = get-winevent application | select -first 1 |
foreach { $_.toxml() }
$xml.event
xmlns System EventData
----- ------ ---------
http://schemas.microsoft.com/win/2004/08/events/event System EventData
Oh I see, you have to restart the appidsvc after setting the group policy. You can use the filepath or fullfilepath properties:
$a = get-winevent "microsoft-windows-applocker/exe and dll" |
select -first 1
[xml]$xml = $a.toxml()
$xml.event.userdata.RuleAndFileData
xmlns : http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0
PolicyNameLength : 3
PolicyName : EXE
RuleId : {fd686d83-a829-4351-8ff4-27c7de5755d2}
RuleNameLength : 24
RuleName : (Default Rule) All files
RuleSddlLength : 53
RuleSddl : D:(XA;;FX;;;S-1-5-32-544;(APPID://PATH Contains "*"))
TargetUser : S-1-5-21-1528843147-373324174-1919417754-1001
TargetProcessId : 3876
FilePathLength : 51
FilePath : %PROGRAMFILES%\GOOGLE\CHROME\APPLICATION\CHROME.EXE
FileHashLength : 0
FileHash :
FqbnLength : 1
Fqbn : -
TargetLogonId : 0x4d253a0
FullFilePathLength : 59
FullFilePath : C:\Program Files (x86)\Google\Chrome\Application\chrome.exe