huntrule

Windows DNS Queries Triggered by DesktopAppInstaller AppInstaller.EXE

Identifies DNS lookups performed by Windows AppInstaller.EXE when initiating ms-appinstaller package installation from a URL.

FreeReviewedSigma · Medium · v2
Product
windows
Category
dns_query
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-11-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies DNS queries initiated by AppInstaller.EXE, the default handler for the ms-appinstaller URI. Attackers can leverage AppInstaller to fetch and load packages from remote URLs, using DNS activity to resolve attacker-controlled domains. It relies on Windows DNS query telemetry and filters to events where the querying process path matches the DesktopAppInstaller AppInstaller.exe location.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange
Malicious JADEPUFFER Lockd Ransomware Payload Download
Malicious Second-Stage Loader Fetch of SLT Payload via Curl or Wget
Possible Remote Payload Download And Execution via Shell (via process_creation)
Suspicious EtherRAT Node.js Implant Background Execution via Shell (via process_creation)
Suspicious Certutil Download and Certificate Installation via Living-off-the-Land
Suspicious PowerShell Remote Script Execution via IEX DownloadString
Suspicious Executable Download from Compromised CMS Client Scripts Path (via proxy)
Suspicious HijackLoader PNG Payload Retrieval via ClearFake
Malicious Download Piped to Shell via curl or wget (via process_creation)
Windows DNS Queries Triggered by DesktopAppInstaller AppInstaller.EXE
Pivot detection · T1105 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.