Windows AppX Packaging: Execute AppX with Suspicious Digital Signature Certificate
Alerts when AppX package execution/signature subject matches a known suspicious certificate in Windows telemetry.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- appxpackaging-om
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-16
- Updated
- 2026-07-31
What it detects
This rule flags AppX package execution when the packaging event includes a certificate subject name matching a known suspicious or malicious signature. Attackers may abuse signed packages to blend in with legitimate software and evade simple trust checks. It relies on Windows AppX packaging telemetry (EventID 157) and the certificate subject name field present in the event.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-appx-packaging-execute-packages-signed-with-a-known-suspicious-certifica-b5aa7d60
title: "Windows AppX Packaging: Execute AppX with Suspicious Digital Signature Certificate"
id: 27177d47-ff5e-43ce-8ce1-dcf4306501d5
status: test
description: This rule flags AppX package execution when the packaging event includes a certificate subject name matching a known suspicious or malicious signature. Attackers may abuse signed packages to blend in with legitimate software and evade simple trust checks. It relies on Windows AppX packaging telemetry (EventID 157) and the certificate subject name field present in the event.
references:
- Internal Research
- https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxpackaging_om/win_appxpackaging_om_sups_appx_signature.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
- attack.execution
- attack.stealth
logsource:
product: windows
service: appxpackaging-om
detection:
selection:
EventID: 157
subjectName: CN=Foresee Consulting Inc., O=Foresee Consulting Inc., L=North York, S=Ontario, C=CA, SERIALNUMBER=1004913-1, OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: b5aa7d60-c17e-4538-97de-09029d6cd76b
type: derived