Detection rules › Sigma

Potentially Suspicious Windows App Activity

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution

MITRE ATT&CK coverage

TacticTechniques
StealthNo specific technique

Event coverage

Rule body yaml

title: Potentially Suspicious Windows App Activity
id: f91ed517-a6ba-471d-9910-b3b4a398c0f3
status: test
description: Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution
references:
    - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
    - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-12
modified: 2025-10-07
tags:
    - attack.stealth
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        # GrandParentImage|endswith: '\sihost.exe'
        ParentImage|contains: 'C:\Program Files\WindowsApps\'
    selection_susp_img:
        Image|endswith:
            # You can add more LOLBINs
            - '\cmd.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
    selection_susp_cli:
        # You can add more potentially suspicious keywords
        CommandLine|contains:
            - 'cmd /c'
            - 'Invoke-'
            - 'Base64'
    filter_optional_terminal:
        ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal'
        ParentImage|endswith: '\WindowsTerminal.exe'
        # Note: to avoid FP add the default shells and profiles that your WT integrates
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
    filter_optional_sysinternals:
        ParentImage|startswith: 'C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite'
        Image|endswith: '\cmd.exe'
    condition: selection_parent and 1 of selection_susp_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate packages that make use of external binaries such as Windows Terminal
level: medium

Stages and Predicates

Stage 0: condition

selection_parent and 1 of selection_susp_* and not 1 of filter_optional_*

Stage 1: selection_parent

selection_parent:
    ParentImage|contains: 'C:\Program Files\WindowsApps\'

Stage 2: selection_susp_img

selection_susp_img:
    Image|endswith:
        - '\cmd.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\powershell.exe'
        - '\powershell_ise.exe'
        - '\pwsh.exe'
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\wscript.exe'

Stage 3: selection_susp_cli

selection_susp_cli:
    CommandLine|contains:
        - 'cmd /c'
        - 'Invoke-'
        - 'Base64'

Stage 4: not filter_optional_*

filter_optional_terminal:
    ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal'
    ParentImage|endswith: '\WindowsTerminal.exe'
    Image|endswith:
        - '\powershell.exe'
        - '\cmd.exe'
        - '\pwsh.exe'
filter_optional_sysinternals:
    ParentImage|startswith: 'C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite'
    Image|endswith: '\cmd.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imageends_with\cmd.exe
Imageends_with\powershell.exe
Imageends_with\pwsh.exe
ParentImageends_with\WindowsTerminal.exe
ParentImagematch:\Program Files\WindowsApps\Microsoft.WindowsTerminal
Imageends_with\cmd.exe
ParentImagestarts_withC:\Program Files\WindowsApps\Microsoft.SysinternalsSuite

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • Base64 corpus 11 (sigma 7, elastic 4)
  • Invoke- corpus 6 (sigma 6)
  • cmd /c corpus 5 (sigma 5)
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \cscript.exe corpus 73 (sigma 73)
  • \mshta.exe corpus 67 (sigma 67)
  • \powershell.exe corpus 182 (sigma 182)
  • \powershell_ise.exe corpus 41 (sigma 41)
  • \pwsh.exe corpus 168 (sigma 168)
  • \regsvr32.exe corpus 65 (sigma 65)
  • \rundll32.exe corpus 95 (sigma 95)
  • \wscript.exe corpus 75 (sigma 75)
ParentImagematch
  • C:\Program Files\WindowsApps\