Suspicious Digital Signature Of AppX Package (via appxpackaging-om)

title: Suspicious Digital Signature Of AppX Package (via appxpackaging-om)
id: 87eb2719-678e-515f-a44e-e7ed030c6734
status: stable
description: This rule detects execution of AppX packages with known anomalous or hostile signature
references:
    - Internal Research
    - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
author: Huntrule Team
date: 2026-04-24
tags:
    - attack.execution
    - attack.stealth
    - attack.defense-evasion
    - attack.t1553.002
    - attack.t1204.002
logsource:
    product: windows
    service: appxpackaging-om
detection:
    selection:
        EventID: 157
        subjectName: 'CN=Foresee Consulting Inc., O=Foresee Consulting Inc., L=North York, S=Ontario, C=CA, SERIALNUMBER=1004913-1, OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization'
    condition: selection
falsepositives:
    - Unknown
level: medium