Windows AppX Deployment: App Package from Common Staging Directories Added to Processing Pipeline

title: "Windows AppX Deployment: App Package from Common Staging Directories Added to Processing Pipeline"
id: b2bd9cc9-c513-49cf-b330-1fc61a92623b
status: test
description: This rule flags AppX packages whose deployment processing indicates they were sourced from commonly used staging locations (e.g., Temp, public user areas, Downloads, Desktop). Attackers can abuse these directories to stage malicious or tampered packages for automated deployment. The detection relies on Windows AppX Deployment Server events with EventID 854 and matches the reported package source Path against a fixed set of staging-directory substrings.
references:
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_in_staging_directory.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
tags:
  - attack.stealth
logsource:
  product: windows
  service: appxdeployment-server
detection:
  selection_eid:
    EventID: 854
  selection_paths_forward:
    Path|contains:
      - :/Perflogs/
      - :/Users/Public/
      - :/Windows/Temp/
      - /AppdData/Local/Temp/
      - /Desktop/
      - /Downloads/
  selection_paths_back:
    Path|contains:
      - :\PerfLogs\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppdData\Local\Temp\
      - \Desktop\
      - \Downloads\
  condition: selection_eid and 1 of selection_paths_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 5cdeaf3d-1489-477c-95ab-c318559fc051
    type: derived