Windows process creation: Suspicious child processes from WindowsApps directory
Alerts on suspicious cmd/PowerShell/mshta/rundll32-style child processes launched from Program Files\WindowsApps.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-12
- Updated
- 2026-07-30
What it detects
This rule flags when a process is spawned from within the WindowsApps installation directory and the child process image matches common scripting or execution utilities (for example cmd.exe, PowerShell variants, mshta, rundll32, and others). It matters because malicious or tampered .appx packages can abuse Windows application execution paths to launch secondary payloads using living-off-the-land binaries. The detection relies on Windows process creation telemetry, specifically the parent process path, child image filename, and command-line substrings associated with script execution or encoded payload handling.
Reporting behind it
- news.sophos.comhttps://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- sentinelone.comhttps://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_appx_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows process creation: Suspicious child processes from WindowsApps directory"
id: 607c0ff5-26e5-462d-bd9b-12291df8fac3
status: test
description: This rule flags when a process is spawned from within the WindowsApps installation directory and the child process image matches common scripting or execution utilities (for example cmd.exe, PowerShell variants, mshta, rundll32, and others). It matters because malicious or tampered .appx packages can abuse Windows application execution paths to launch secondary payloads using living-off-the-land binaries. The detection relies on Windows process creation telemetry, specifically the parent process path, child image filename, and command-line substrings associated with script execution or encoded payload handling.
references:
- https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_appx_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-12
modified: 2025-10-07
tags:
- attack.stealth
logsource:
product: windows
category: process_creation
detection:
selection_parent:
ParentImage|contains: C:\Program Files\WindowsApps\
selection_susp_img:
Image|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \powershell_ise.exe
- \pwsh.exe
- \regsvr32.exe
- \rundll32.exe
- \wscript.exe
selection_susp_cli:
CommandLine|contains:
- cmd /c
- Invoke-
- Base64
filter_optional_terminal:
ParentImage|contains: :\Program Files\WindowsApps\Microsoft.WindowsTerminal
ParentImage|endswith: \WindowsTerminal.exe
Image|endswith:
- \powershell.exe
- \cmd.exe
- \pwsh.exe
filter_optional_sysinternals:
ParentImage|startswith: C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite
Image|endswith: \cmd.exe
condition: selection_parent and 1 of selection_susp_* and not 1 of filter_optional_*
falsepositives:
- Legitimate packages that make use of external binaries such as Windows Terminal
level: medium
license: DRL-1.1
related:
- id: f91ed517-a6ba-471d-9910-b3b4a398c0f3
type: derived