I’ve been using Windows 10 and Applocker in ‘Allow mode’ for some time and I need to filter the noise left by the Constrained Mode from the event log.
Windows 10 and PowerShell 5.x introduce a way to protect the interactive shell from copy/paste. If you configure Applocker in ‘Allow mode’ (don’t use default rules when proposed by the GUI), your interactive shell starts in a different LanguageMode named ‘Constrained mode’. Want to read more, start with PowerShell ♥ the Blue Team and about_Language_Modes.
Here’s a quick demo in a picture is worth a thousand words:
Although I’m running an interactive shell with administrative privileges, I cannot use the ToXML() method. I get the symptomatic error message Cannot invoke method. Method invocation is supported only on core types in this language mode.
What’s the challenge here?
It should work in constrained mode and I should figure out the correct XML query 🙄
In other words, I need to find 8007 events from the ‘Microsoft-Windows-AppLocker/MSI and Script’ event log but not those that have the filehash (SHA256) set to: 6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
This hash is well known, it’s a file with only 1 as content.
Here’s the tip:
|Get-WinEvent -FilterXml @'|
|<Query Id="0" Path="Microsoft-Windows-AppLocker/MSI and Script">|
|<Select Path="Microsoft-Windows-AppLocker/MSI and Script">|
|'@ -MaxEvents 1|
If you use the GUI, you can copy/paste the above XML query in the eventvwr