Windows AppX Deployment Fails Due to Unsatisfied Signing Requirements (0x80073cff)

title: Windows AppX Deployment Fails Due to Unsatisfied Signing Requirements (0x80073cff)
id: 75ef1a68-09d4-431c-824b-a2a1de73c8c1
status: test
description: This rule flags AppX package deployment or installation attempts that fail with error code 0x80073cff, indicating the package did not meet signing requirements. Attackers may trigger such failures when testing or attempting to distribute improperly signed AppX content. The detection relies on Windows AppX deployment telemetry, specifically Event ID 401 with the specified ErrorCode.
references:
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_deployment_failed_signing_requirements.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
modified: 2025-12-03
tags:
  - attack.stealth
logsource:
  product: windows
  service: appxdeployment-server
detection:
  selection:
    EventID: 401
    ErrorCode: "0x80073cff"
  condition: selection
falsepositives:
  - Legitimate AppX packages not signed by MS used part of an enterprise.
level: medium
license: DRL-1.1
related:
  - id: 898d5fc9-fbc3-43de-93ad-38e97237c344
    type: derived