Application Uninstalled — Sigma Rule

Rule metadata and linked tags

Author: frack113. Source status: test; severity: low. Source dates: 2022-01-28 / 2022-09-17.

{
  "product": "windows",
  "service": "application"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 70b248b4e5cedd7b4151bfe8532d64e5bfef9e81efaadab4146f657dc3c6c7ff

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Application Uninstalled
id: 570ae5ec-33dc-427c-b815-db86228ad43e
status: test
description: An application has been removed. Check if it is critical.
references:
    - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml
    - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
author: frack113
date: 2022-01-28
modified: 2022-09-17
tags:
    - attack.impact
    - attack.t1489
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'MsiInstaller'
        EventID:
            - 1034 # Windows Installer removed the product
            - 11724 # Product Removal Successful
    condition: selection
falsepositives:
    - Unknown
# Level is low as it can be very verbose, you can use the top or less 10 "Product Name" to have a quick overview
level: low

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml
• https://learn.microsoft.com/en-us/windows/win32/msi/event-logging