Windows AppX Deployment Blocked by Local Policy
Detects blocked AppX package deployments on Windows via AppXDeployment-Server policy-denial Event IDs.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- appxdeployment-server
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-01-11
- Updated
- 2026-07-31
What it detects
This rule flags AppX package deployment attempts that are blocked by local policy. Such blocks can indicate attacker attempts to install or deploy Windows Store/AppX software despite restrictions. It relies on Windows AppX Deployment Server events with Event IDs 441, 442, 453, or 454 indicating policy- or platform-based blocking.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- github.comhttps://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_policy_block.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-appx-package-deployment-blocked-by-local-policy-appxdeployment-server-e021bbb5
title: Windows AppX Deployment Blocked by Local Policy
id: 090cb287-e3ed-4d49-9f3e-45a7b5b170ef
status: test
description: This rule flags AppX package deployment attempts that are blocked by local policy. Such blocks can indicate attacker attempts to install or deploy Windows Store/AppX software despite restrictions. It relies on Windows AppX Deployment Server events with Event IDs 441, 442, 453, or 454 indicating policy- or platform-based blocking.
references:
- https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
- https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_policy_block.yml
author: frack113, Huntrule Team
date: 2023-01-11
tags:
- attack.defense-impairment
logsource:
product: windows
service: appxdeployment-server
detection:
selection:
EventID:
- 441
- 442
- 453
- 454
condition: selection
falsepositives:
- Unlikely, since this event notifies about blocked application deployment. Tune your applocker rules to avoid blocking legitimate applications.
level: medium
license: DRL-1.1
related:
- id: e021bbb5-407f-41f5-9dc9-1864c45a7a51
type: derived