Suspicious AppX Package Installation Attempts on Windows via AppX Deployment Service

Alerts on Windows AppX deployment events tied to a known-malicious AppX package identifier.

FreeUnreviewedSigmamediumv1

suspicious-appx-package-installation-attempts-on-windows-via-appx-deployment-ser-09d3b48b

title: Suspicious AppX Package Installation Attempts on Windows via AppX Deployment Service
id: d2025a2e-bb17-46b0-aa38-abab503d18c6
status: test
description: This rule flags AppX deployment events (EventID 400 or 401) where the AppX package full name contains a specific known-bad identifier. Malicious actors may use the Windows AppX mechanism to stealthily install payloads packaged as legitimate app formats. It relies on Windows AppX deployment server telemetry that records the deployment event ID and the package full name.
references:
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
  - https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
modified: 2023-01-12
tags:
  - attack.stealth
logsource:
  product: windows
  service: appxdeployment-server
detection:
  selection:
    EventID:
      - 400
      - 401
    PackageFullName|contains: 3669e262-ec02-4e9d-bcb4-3d008b4afac9
  condition: selection
falsepositives:
  - Rare occasions where a malicious package uses the exact same name and version as a legitimate application.
level: medium
license: DRL-1.1
related:
  - id: 09d3b48b-be17-47f5-bf4e-94e7e75d09ce
    type: derived

What it detects

This rule flags AppX deployment events (EventID 400 or 401) where the AppX package full name contains a specific known-bad identifier. Malicious actors may use the Windows AppX mechanism to stealthily install payloads packaged as legitimate app formats. It relies on Windows AppX deployment server telemetry that records the deployment event ID and the package full name.

Known false positives

Rare occasions where a malicious package uses the exact same name and version as a legitimate application.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.