Windows AppX Deployment: Uncommon Appx Path Added to Deployment Pipeline
Alerts when an AppX package is queued for processing from uncommon paths or URLs in Windows AppX deployment server events.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- appxdeployment-server
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-11
- Updated
- 2026-07-31
What it detects
This rule flags Windows AppX deployment events (EventID 854) where an appx package appears in the deployment pipeline and its Path matches uncommon or suspicious locations. Attackers may abuse the AppX deployment mechanism to stage and deliver malicious packages from atypical directories rather than expected sources. The detection relies on telemetry from the AppX deployment server event stream and examines the Path field for specific directory and URL patterns indicative of unusual package locations.
Reporting behind it
- Internal ResearchInternal Research
- sentinelone.comhttps://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- news.sophos.comhttps://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-appx-deployment-server-uncommon-appx-path-added-to-processing-pipeline-c977cb50
title: "Windows AppX Deployment: Uncommon Appx Path Added to Deployment Pipeline"
id: 1a850de7-d166-4c84-8800-2587657797ea
status: test
description: This rule flags Windows AppX deployment events (EventID 854) where an appx package appears in the deployment pipeline and its Path matches uncommon or suspicious locations. Attackers may abuse the AppX deployment mechanism to stage and deliver malicious packages from atypical directories rather than expected sources. The detection relies on telemetry from the AppX deployment server event stream and examines the Path field for specific directory and URL patterns indicative of unusual package locations.
references:
- Internal Research
- https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
modified: 2025-12-03
tags:
- attack.stealth
logsource:
product: windows
service: appxdeployment-server
detection:
selection:
EventID: 854
filter_main_generic:
Path|contains:
- :/Program%20Files
- :/Windows/System32/
- :\Program Files (x86)\
- :\Program Files\
- :\Windows\ImmersiveControlPanel\
- :\Windows\PrintDialog\
- :\Windows\SystemApps\
- AppData/Local/Temp/WinGet/Microsoft.Winget.Source
- x-windowsupdate://
filter_main_specific:
Path|contains:
- https://installer.teams.static.microsoft/
- https://res.cdn.office.net
- https://statics.teams.cdn.live.net/
- https://statics.teams.cdn.office.net/
- microsoft.com
filter_optional_onedrive:
Path|contains: AppData\Local\Microsoft\OneDrive\
filter_optional_winget:
Path|contains:
- AppData/Local/Temp/WinGet/Microsoft.Winget.Source
- AppData\Local\Temp\WinGet\Microsoft.Winget.Source
filter_optional_x_windowsupdate:
Path|contains: x-windowsupdate://
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: c977cb50-3dff-4a9f-b873-9290f56132f1
type: derived