CmdID

CmdID / PowerShell / Cmdlets / Get

Get-AppLockerPolicy

Gets the local, the effective, or a domain AppLocker policy. Windows Server PowerShell reference

From the Windows Server PowerShell reference 5 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

5 in the Windows Server PowerShell reference
-DomainGets the AppLocker policy from the GPO specified by the path given in the *Ldap* parameter.
-EffectiveGets the effective AppLocker policy on the local computer.
-LdapSpecifies the LDAP path of the GPO and must specify a unique GPO.
-LocalGets the AppLocker policy from the local GPO.
-XmlSpecifies that the AppLocker policy be output as an XML-formatted string.

What looks for it

Sigma process creation rules that name Get-AppLockerPolicy
lowPowerShell AppLocker Policy Discovery Via Get-AppLockerPolicyTom3306