Possible Application Uninstalled (via application)

title: Possible Application Uninstalled (via application)
id: 84142ab7-6e18-50c0-a3e5-5b6e4e380429
status: stable
description: This rule detects an application has been removed. Check if it is critical.
references:
    - https://attack.mitre.org/techniques/T1489/
    - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml
    - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
author: Huntrule Team
date: 2026-02-09
tags:
    - attack.impact
    - attack.t1489
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'MsiInstaller'
        EventID:
            - 1034
            - 11724
    condition: selection
falsepositives:
    - Unknown
level: low