Possible Malicious AppX Package Deployment Attempts (via appxdeployment-server)

title: Possible Malicious AppX Package Deployment Attempts (via appxdeployment-server)
id: 9100bc36-56c9-5357-9037-934595251506
status: stable
description: This rule detects potential installation or installation attempts of known hostile appx packages
references:
    - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
    - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
    - https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/
author: Huntrule Team
date: 2026-02-21
tags:
    - attack.stealth
    - attack.execution
    - attack.t1204.002
logsource:
    product: windows
    service: appxdeployment-server
detection:
    selection:
        EventID:
            - 400
            - 401
        PackageFullName|contains: '3669e262-ec02-4e9d-bcb4-3d008b4afac9'
    condition: selection
falsepositives:
    - Unknown
level: medium