This rule detects potential AppLocker policy enumeration attempts in Windows by monitoring PowerShell activity that calls Get-AppLockerPolicy. It targets processes (powershell.exe or pwsh.exe) whose command line includes the Get-AppLockerPolicy cmdlet and a policy scope flag (-Effective, -LDAP, or -Local). The combination of a PowerShell process, the Get-AppLockerPolicy invocation, and a scope flag indicates an AppLocker policy discovery attempt, which is a known reconnaissance technique (ATT&CK T1518.001). While this can be legitimate auditing by administrators, the rule helps surface potential misuse or unauthorized enumeration. False positives include routine administrative troubleshooting, legitimate policy validation, or scripted maintenance. The rule operates on Windows process creation events and examines the process image, original file name, and command line for the detection criteria, aligning with typical EDR/SIEM behavior for discovery activities.