Windows AppX Deployment Server: Uncommon AppX Path Added to Processing Pipeline

title: "Windows AppX Deployment Server: Uncommon AppX Path Added to Processing Pipeline"
id: 1a850de7-d166-4c84-8800-2587657797ea
status: test
description: This rule flags AppX packages added to the deployment server’s "to be processed" pipeline when the package path contains uncommon or unexpected locations (e.g., Windows system directories or specific temp/source paths). Attackers can abuse legitimate AppX distribution mechanisms to deliver and stage application payloads in less-suspicious filesystem locations. The detection relies on Windows AppX deployment server telemetry with EventID 854 and examines the reported Path value for matching uncommon directory and URL patterns, while excluding known/common optional sources.
references:
  - Internal Research
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
modified: 2025-12-03
tags:
  - attack.stealth
logsource:
  product: windows
  service: appxdeployment-server
detection:
  selection:
    EventID: 854
  filter_main_generic:
    Path|contains:
      - :/Program%20Files
      - :/Windows/System32/
      - :\Program Files (x86)\
      - :\Program Files\
      - :\Windows\ImmersiveControlPanel\
      - :\Windows\PrintDialog\
      - :\Windows\SystemApps\
      - AppData/Local/Temp/WinGet/Microsoft.Winget.Source
      - x-windowsupdate://
  filter_main_specific:
    Path|contains:
      - https://installer.teams.static.microsoft/
      - https://res.cdn.office.net
      - https://statics.teams.cdn.live.net/
      - https://statics.teams.cdn.office.net/
      - microsoft.com
  filter_optional_onedrive:
    Path|contains: AppData\Local\Microsoft\OneDrive\
  filter_optional_winget:
    Path|contains:
      - AppData/Local/Temp/WinGet/Microsoft.Winget.Source
      - AppData\Local\Temp\WinGet\Microsoft.Winget.Source
  filter_optional_x_windowsupdate:
    Path|contains: x-windowsupdate://
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c977cb50-3dff-4a9f-b873-9290f56132f1
    type: derived