Windows AppX Package Deployment Blocked by Local Policy (AppXDeployment-Server)

title: Windows AppX Package Deployment Blocked by Local Policy (AppXDeployment-Server)
id: 090cb287-e3ed-4d49-9f3e-45a7b5b170ef
status: test
description: This rule flags Windows AppX package deployments that are denied by local computer or platform policy. Such blocks matter because attackers may attempt AppX-based application installation or persistence, and repeated policy denials can indicate policy enforcement or hostile installation attempts. The detection relies on AppXDeployment-Server events with specific Event IDs (441, 442, 453, 454) indicating the deployment or package was blocked by policy.
references:
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_policy_block.yml
author: frack113, Huntrule Team
date: 2023-01-11
tags:
  - attack.defense-impairment
logsource:
  product: windows
  service: appxdeployment-server
detection:
  selection:
    EventID:
      - 441
      - 442
      - 453
      - 454
  condition: selection
falsepositives:
  - Unlikely, since this event notifies about blocked application deployment. Tune your applocker rules to avoid blocking legitimate applications.
level: medium
license: DRL-1.1
related:
  - id: e021bbb5-407f-41f5-9dc9-1864c45a7a51
    type: derived