{"id":"e54279c7-4910-4e2c-902c-c56a25b549f6","title":"Windows AppX Deployment Full Trust Package Installation","description":"Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions","author":"Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-11-03","modified":"","tags":["attack.execution","attack.defense-impairment","attack.t1204.002","attack.t1553.005"],"technique_ids":["T1204.002","T1553.005"],"logsource":{"product":"windows","service":"appxdeployment-server"},"falsepositives":["Some legitimate applications installation which have been missed from filtering can generate fps, thus baselining and tuning is recommended before deploying to production"],"references":["https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html"],"source_path":"rules/windows/builtin/appxdeployment_server/win_appxpackaging_server_full_trust_package_installation.yml","source_sha256":"5bc56c6541bf0ae557e1527efac93592f028054ab2990e86c76ce8d69e6d2541","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/appxdeployment_server/win_appxpackaging_server_full_trust_package_installation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows AppX Deployment Full Trust Package Installation\nid: e54279c7-4910-4e2c-902c-c56a25b549f6\nstatus: experimental\ndescription: Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions\nreferences:\n    - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html\nauthor: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-03\ntags:\n    - attack.execution\n    - attack.defense-impairment\n    - attack.t1204.002\n    - attack.t1553.005\nlogsource:\n    product: windows\n    service: appxdeployment-server\ndetection:\n    selection:\n        EventID: 400\n        HasFullTrust: true\n    filter_main_legitpath:\n        PackageSourceUri|startswith:\n            - 'file:///C:/Program%20Files/'\n            - 'file:///C:/Program%20Files%20(x86)/'\n    filter_main_microsoft:\n        - PackageSourceUri|startswith: 'https://go.microsoft.com/fwlink/?linkid'\n        - PackageSourceUri|contains:\n              - '.cdn.microsoft.com'\n              - '.cdn.office.net/'\n    filter_main_callerprocess:\n        CallingProcess|startswith:\n            - 'sysprep.exe'\n            - 'svchost.exe,AppReadiness'\n    filter_optional_x_update:\n        PackageSourceUri|startswith: 'x-windowsupdate://'\n    filter_optional_microsoftclient:\n        PackageFullName|startswith: 'MicrosoftWindows.Client.'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Some legitimate applications installation which have been missed from filtering can generate fps, thus baselining and tuning is recommended before deploying to production\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"},{"key":"enterprise/T1553.005","id":"T1553.005","name":"Mark-of-the-Web Bypass","page":"techniques/enterprise/T1553.005/"}],"data_path":"data/detection-rules/e54279c7-4910-4e2c-902c-c56a25b549f6.json","kind":"sigma"}