Windows AppInstaller.EXE DNS Queries During ms-appinstaller Package Installation

title: Windows AppInstaller.EXE DNS Queries During ms-appinstaller Package Installation
id: f8c7c71f-5e44-4cff-9c1e-decdebab2982
related:
  - id: 180c7c5c-d64b-4a63-86e9-68910451bc8b
    type: derived
  - id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a
    type: derived
status: test
description: This rule flags DNS queries made by AppInstaller.EXE, the default handler for the ms-appinstaller URI. Attackers and users can trigger AppInstaller to retrieve and install packages from external URLs, making outbound name resolution an observable indicator of package retrieval activity. The detection relies on Windows DNS query telemetry with the process image path matching the AppInstaller executable.
references:
  - https://twitter.com/notwhickey/status/1333900137232523264
  - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_appinstaller.yml
author: frack113, Huntrule Team
date: 2021-11-24
modified: 2023-11-09
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    Image|startswith: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_
    Image|endswith: \AppInstaller.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1