Windows AppX Deployment: Staged Directory Package Added to Pipeline
Alerts when AppX deployment processing references a package located in typical staging directories such as Temp or Downloads.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- appxdeployment-server
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-11
- Updated
- 2026-07-31
What it detects
This rule flags Windows AppX deployment server events where an AppX package is queued into the pipeline for processing and the package path contains common staging directories. Attackers may abuse staging locations to prepare or stage malicious packages for subsequent deployment activity. It relies on AppX deployment server telemetry with EventID 854 and the reported package Path values matching known directory patterns.
Reporting behind it
- sentinelone.comhttps://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- news.sophos.comhttps://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_in_staging_directory.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-appx-deployment-app-package-from-common-staging-directories-added-to-pro-5cdeaf3d
title: "Windows AppX Deployment: Staged Directory Package Added to Pipeline"
id: b2bd9cc9-c513-49cf-b330-1fc61a92623b
status: test
description: This rule flags Windows AppX deployment server events where an AppX package is queued into the pipeline for processing and the package path contains common staging directories. Attackers may abuse staging locations to prepare or stage malicious packages for subsequent deployment activity. It relies on AppX deployment server telemetry with EventID 854 and the reported package Path values matching known directory patterns.
references:
- https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_in_staging_directory.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
tags:
- attack.stealth
logsource:
product: windows
service: appxdeployment-server
detection:
selection_eid:
EventID: 854
selection_paths_forward:
Path|contains:
- :/Perflogs/
- :/Users/Public/
- :/Windows/Temp/
- /AppdData/Local/Temp/
- /Desktop/
- /Downloads/
selection_paths_back:
Path|contains:
- :\PerfLogs\
- :\Users\Public\
- :\Windows\Temp\
- \AppdData\Local\Temp\
- \Desktop\
- \Downloads\
condition: selection_eid and 1 of selection_paths_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 5cdeaf3d-1489-477c-95ab-c318559fc051
type: derived