Windows AppX Package Deployment: Suspicious AppX Installation Attempts by PackageFullName
Alerts on Windows AppX deployment events tied to a known-malicious AppX package identifier.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- appxdeployment-server
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-11
- Updated
- 2026-07-31
What it detects
This rule flags AppX deployment server events indicating an installation or attempted installation of a specific known-bad AppX package, based on matching the PackageFullName substring. Attackers can abuse the Windows AppX mechanism to stealthily deliver and execute malicious components through the app deployment workflow. It relies on Windows telemetry from the appxdeployment-server service with EventID 400 or 401 and PackageFullName containing the marked identifier.
Reporting behind it
- sentinelone.comhttps://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- news.sophos.comhttps://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- forensicitguy.github.iohttps://forensicitguy.github.io/analyzing-magnitude-magniber-appx/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
suspicious-appx-package-installation-attempts-on-windows-via-appx-deployment-ser-09d3b48b
title: "Windows AppX Package Deployment: Suspicious AppX Installation Attempts by PackageFullName"
id: d2025a2e-bb17-46b0-aa38-abab503d18c6
status: test
description: This rule flags AppX deployment server events indicating an installation or attempted installation of a specific known-bad AppX package, based on matching the PackageFullName substring. Attackers can abuse the Windows AppX mechanism to stealthily deliver and execute malicious components through the app deployment workflow. It relies on Windows telemetry from the appxdeployment-server service with EventID 400 or 401 and PackageFullName containing the marked identifier.
references:
- https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
modified: 2023-01-12
tags:
- attack.stealth
logsource:
product: windows
service: appxdeployment-server
detection:
selection:
EventID:
- 400
- 401
PackageFullName|contains: 3669e262-ec02-4e9d-bcb4-3d008b4afac9
condition: selection
falsepositives:
- Rare occasions where a malicious package uses the exact same name and version as a legitimate application.
level: medium
license: DRL-1.1
related:
- id: 09d3b48b-be17-47f5-bf4e-94e7e75d09ce
type: derived