Detection rules › By event

Microsoft-Windows-AppXDeployment-Server

Event	Rules
Event ID 400	3
Event ID 401	2
Event ID 412	1
Event ID 441	1
Event ID 442	1
Event ID 453	1
Event ID 454	1
Event ID 603	2
Event ID 854	5
Event ID 855	2

Event ID 400

3 detection rules reference this event. View event page.

Sigma (2)

Potential Malicious AppX Package Installation Attempts severity medium
Windows AppX Deployment Full Trust Package Installation severity medium T1204, T1204.002, T1553, T1553.005

Splunk (1)

Windows AppX Deployment Full Trust Package Installation T1204, T1204.002, T1553, T1553.005

Event ID 401

2 detection rules reference this event. View event page.

Sigma (2)

AppX Package Deployment Failed Due to Signing Requirements severity medium
Potential Malicious AppX Package Installation Attempts severity medium

Event ID 412

1 detection rules reference this event. View event page.

Sigma (1)

Deployment AppX Package Was Blocked By AppLocker severity medium

Event ID 441

1 detection rules reference this event. View event page.

Sigma (1)

Deployment Of The AppX Package Was Blocked By The Policy severity medium

Event ID 442

1 detection rules reference this event. View event page.

Sigma (1)

Deployment Of The AppX Package Was Blocked By The Policy severity medium

Event ID 453

1 detection rules reference this event. View event page.

Sigma (1)

Deployment Of The AppX Package Was Blocked By The Policy severity medium

Event ID 454

1 detection rules reference this event. View event page.

Sigma (1)

Deployment Of The AppX Package Was Blocked By The Policy severity medium

Event ID 603

2 detection rules reference this event. View event page.

Sigma (1)

Windows AppX Deployment Unsigned Package Installation severity medium T1204, T1204.002, T1553, T1553.005

Splunk (1)

Windows AppX Deployment Unsigned Package Installation severity medium T1204, T1204.002, T1553, T1553.005

Event ID 854

5 detection rules reference this event. View event page.

Sigma (4)

AppX Located in Known Staging Directory Added to Deployment Pipeline severity high
AppX Located in Uncommon Directory Added to Deployment Pipeline severity medium
Remote AppX Package Downloaded from File Sharing or CDN Domain severity high
Successful MSIX/AppX Package Installation severity low T1204, T1204.002

Splunk (1)

Windows AppX Deployment Package Installation Success severity low T1204, T1204.002

Event ID 855

2 detection rules reference this event. View event page.

Splunk (2)

Windows AppX Deployment Unsigned Package Installation severity medium T1204, T1204.002, T1553, T1553.005
Windows Developer-Signed MSIX Package Installation severity low T1204, T1204.002, T1553, T1553.005