Windows AppX deployment blocked by AppLocker (AppXDeployment-Server EventID 412)
Flags AppX package deployment attempts that AppLocker blocked, based on AppXDeployment-Server EventID 412.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- appxdeployment-server
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-01-11
- Updated
- 2026-07-31
What it detects
This rule flags AppX package deployment attempts that were blocked due to AppLocker policy. Blocking application deployment can be used by attackers to evade normal execution paths or to interfere with software install workflows, and defenders should investigate when deployments fail for policy reasons. It relies on Windows AppXDeployment-Server telemetry, matching AppXDeployment-Server EventID 412 events indicating AppLocker denial.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- github.comhttps://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_applocker_block.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-appx-package-deployment-blocked-by-applocker-appxdeployment-server-event-6ae53108
title: Windows AppX deployment blocked by AppLocker (AppXDeployment-Server EventID 412)
id: 29fbb6b0-50f7-4487-9f35-f7718dd9d040
status: test
description: This rule flags AppX package deployment attempts that were blocked due to AppLocker policy. Blocking application deployment can be used by attackers to evade normal execution paths or to interfere with software install workflows, and defenders should investigate when deployments fail for policy reasons. It relies on Windows AppXDeployment-Server telemetry, matching AppXDeployment-Server EventID 412 events indicating AppLocker denial.
references:
- https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_applocker_block.yml
author: frack113, Huntrule Team
date: 2023-01-11
tags:
- attack.stealth
logsource:
product: windows
service: appxdeployment-server
detection:
selection:
EventID: 412
condition: selection
falsepositives:
- Unlikely, since this event notifies about blocked application deployment. Tune your applocker rules to avoid blocking legitimate applications.
level: medium
license: DRL-1.1
related:
- id: 6ae53108-c3a0-4bee-8f45-c7591a2c337f
type: derived