Windows process creation: Suspicious child processes from WindowsApps directory

title: "Windows process creation: Suspicious child processes from WindowsApps directory"
id: 607c0ff5-26e5-462d-bd9b-12291df8fac3
status: test
description: This rule flags when a process is spawned from within the WindowsApps installation directory and the child process image matches common scripting or execution utilities (for example cmd.exe, PowerShell variants, mshta, rundll32, and others). It matters because malicious or tampered .appx packages can abuse Windows application execution paths to launch secondary payloads using living-off-the-land binaries. The detection relies on Windows process creation telemetry, specifically the parent process path, child image filename, and command-line substrings associated with script execution or encoded payload handling.
references:
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_appx_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-12
modified: 2025-10-07
tags:
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|contains: C:\Program Files\WindowsApps\
  selection_susp_img:
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
  selection_susp_cli:
    CommandLine|contains:
      - cmd /c
      - Invoke-
      - Base64
  filter_optional_terminal:
    ParentImage|contains: :\Program Files\WindowsApps\Microsoft.WindowsTerminal
    ParentImage|endswith: \WindowsTerminal.exe
    Image|endswith:
      - \powershell.exe
      - \cmd.exe
      - \pwsh.exe
  filter_optional_sysinternals:
    ParentImage|startswith: C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite
    Image|endswith: \cmd.exe
  condition: selection_parent and 1 of selection_susp_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate packages that make use of external binaries such as Windows Terminal
level: medium
license: DRL-1.1
related:
  - id: f91ed517-a6ba-471d-9910-b3b4a398c0f3
    type: derived