{"id":"570ae5ec-33dc-427c-b815-db86228ad43e","title":"Application Uninstalled","description":"An application has been removed. Check if it is critical.","author":"frack113","status":"test","level":"low","date":"2022-01-28","modified":"2022-09-17","tags":["attack.impact","attack.t1489"],"technique_ids":["T1489"],"logsource":{"product":"windows","service":"application"},"falsepositives":["Unknown"],"references":["https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml","https://learn.microsoft.com/en-us/windows/win32/msi/event-logging"],"source_path":"rules/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml","source_sha256":"70b248b4e5cedd7b4151bfe8532d64e5bfef9e81efaadab4146f657dc3c6c7ff","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Application Uninstalled\nid: 570ae5ec-33dc-427c-b815-db86228ad43e\nstatus: test\ndescription: An application has been removed. Check if it is critical.\nreferences:\n    - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml\n    - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging\nauthor: frack113\ndate: 2022-01-28\nmodified: 2022-09-17\ntags:\n    - attack.impact\n    - attack.t1489\nlogsource:\n    product: windows\n    service: application\ndetection:\n    selection:\n        Provider_Name: 'MsiInstaller'\n        EventID:\n            - 1034 # Windows Installer removed the product\n            - 11724 # Product Removal Successful\n    condition: selection\nfalsepositives:\n    - Unknown\n# Level is low as it can be very verbose, you can use the top or less 10 \"Product Name\" to have a quick overview\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1489","id":"T1489","name":"Service Stop","page":"techniques/enterprise/T1489/"}],"data_path":"data/detection-rules/570ae5ec-33dc-427c-b815-db86228ad43e.json","kind":"sigma"}