Get-AppLockerEventlog - Script For Fetching Applocker Event Log By Parsing The Win-Event Log

This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order to troubleshoot. Here are the logs we fetch from win-event:

• EXE and DLL,
• MSI and Script,
• Packaged app-Deployment,
• Packaged app-Execution.

The output:

• The result will be displayed on the screen
  

• And, The result will be saved …

applocker event log parsing script