Windows Successful MSIX/AppX Package Installation via Event ID 854 (AppXDeployment-Server)

title: Windows Successful MSIX/AppX Package Installation via Event ID 854 (AppXDeployment-Server)
id: 29eed768-b613-4052-bdb5-4ba4b0ad206c
status: experimental
description: This rule identifies successful MSIX/AppX package installations on Windows by matching EventID 854 from the Microsoft-Windows-AppXDeployment-Server/Operational log. Successful package installation can be a precursor to execution or persistence if an attacker uses crafted packages. The detection relies on Windows event telemetry for the specific installation success event.
references:
  - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/appxdeployment_server/win_appxpackaging_server_successful_package_installation.yml
author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-03
tags:
  - attack.execution
  - attack.t1204.002
  - detection.threat-hunting
logsource:
  product: windows
  service: appxdeployment-server
detection:
  selection:
    EventID: 854
  condition: selection
falsepositives:
  - Legitimate MSIX/AppX package installations
level: low
license: DRL-1.1
related:
  - id: 289dfa9e-e378-4a56-a9d4-7ed5ee218029
    type: derived