Windows AppX Packaging: Execute packages signed with a known suspicious certificate

title: "Windows AppX Packaging: Execute packages signed with a known suspicious certificate"
id: 27177d47-ff5e-43ce-8ce1-dcf4306501d5
status: test
description: This rule flags AppX packaging events where the AppX package signature subject matches a specific known suspicious certificate. Signed packages can be used to blend into legitimate software distribution workflows, so targeting certificate subject matches helps surface abuse attempts. The detection relies on Windows AppX packaging telemetry (EventID 157) including the signature subject name.
references:
  - Internal Research
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxpackaging_om/win_appxpackaging_om_sups_appx_signature.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
  - attack.execution
  - attack.stealth
logsource:
  product: windows
  service: appxpackaging-om
detection:
  selection:
    EventID: 157
    subjectName: CN=Foresee Consulting Inc., O=Foresee Consulting Inc., L=North York, S=Ontario, C=CA, SERIALNUMBER=1004913-1, OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b5aa7d60-c17e-4538-97de-09029d6cd76b
    type: derived