Windows AppX Deployment Failure (0x80073cff) Due to Signing Requirements
Alerts on Windows AppX deployments/installations failing with 0x80073cff, consistent with unmet signing requirements.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- appxdeployment-server
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-11
- Updated
- 2026-07-31
What it detects
This rule flags AppX package deployment and installation failures on Windows when the error code is 0x80073cff, indicating the package did not meet signing requirements. Attackers may exploit or attempt to deploy unsigned or improperly signed packages to gain persistence or execute malicious components, making these failures useful for early triage. The detection relies on Windows AppX deployment server events containing EventID 401 and an ErrorCode value of 0x80073cff.
Reporting behind it
- sentinelone.comhttps://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- news.sophos.comhttps://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_deployment_failed_signing_requirements.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-appx-deployment-fails-due-to-unsatisfied-signing-requirements-0x80073cff-898d5fc9
title: Windows AppX Deployment Failure (0x80073cff) Due to Signing Requirements
id: 75ef1a68-09d4-431c-824b-a2a1de73c8c1
status: test
description: This rule flags AppX package deployment and installation failures on Windows when the error code is 0x80073cff, indicating the package did not meet signing requirements. Attackers may exploit or attempt to deploy unsigned or improperly signed packages to gain persistence or execute malicious components, making these failures useful for early triage. The detection relies on Windows AppX deployment server events containing EventID 401 and an ErrorCode value of 0x80073cff.
references:
- https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_deployment_failed_signing_requirements.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
modified: 2025-12-03
tags:
- attack.stealth
logsource:
product: windows
service: appxdeployment-server
detection:
selection:
EventID: 401
ErrorCode: "0x80073cff"
condition: selection
falsepositives:
- Legitimate AppX packages not signed by MS used part of an enterprise.
level: medium
license: DRL-1.1
related:
- id: 898d5fc9-fbc3-43de-93ad-38e97237c344
type: derived