Windows AppX Package Deployment Blocked by AppLocker (AppXDeployment-Server Event 412)

Flags AppX package deployment attempts that AppLocker blocked, based on AppXDeployment-Server EventID 412.

FreeUnreviewedSigmamediumv1

windows-appx-package-deployment-blocked-by-applocker-appxdeployment-server-event-6ae53108

title: Windows AppX Package Deployment Blocked by AppLocker (AppXDeployment-Server Event 412)
id: 29fbb6b0-50f7-4487-9f35-f7718dd9d040
status: test
description: This rule identifies AppX package deployments that were blocked by an AppLocker policy, using Windows AppXDeployment-Server telemetry. Blocking deployment can be used by defenders, but attackers may attempt repeated delivery of blocked packages to probe policy behavior or disrupt application execution. The detection relies on an event match for EventID 412 from the AppXDeployment-Server service.
references:
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_applocker_block.yml
author: frack113, Huntrule Team
date: 2023-01-11
tags:
  - attack.stealth
logsource:
  product: windows
  service: appxdeployment-server
detection:
  selection:
    EventID: 412
  condition: selection
falsepositives:
  - Unlikely, since this event notifies about blocked application deployment. Tune your applocker rules to avoid blocking legitimate applications.
level: medium
license: DRL-1.1
related:
  - id: 6ae53108-c3a0-4bee-8f45-c7591a2c337f
    type: derived

What it detects

This rule identifies AppX package deployments that were blocked by an AppLocker policy, using Windows AppXDeployment-Server telemetry. Blocking deployment can be used by defenders, but attackers may attempt repeated delivery of blocked packages to probe policy behavior or disrupt application execution. The detection relies on an event match for EventID 412 from the AppXDeployment-Server service.

Known false positives

Unlikely, since this event notifies about blocked application deployment. Tune your applocker rules to avoid blocking legitimate applications.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.