AppX Package Deployment Failed Due to Signing Requirements

Status: test
Severity: medium
Log source: product windows, service appxdeployment-server
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn't meet the signing requirements.

Known false positives

Legitimate AppX packages not signed by MS used part of an enterprise.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
AppXDeployment-Server	Event ID 401: Deployment DeploymentOperation operation with target volume MountPoint on Package PackageFullName from: Path failed with error ErrorCode.

Rule body

title: AppX Package Deployment Failed Due to Signing Requirements
id: 898d5fc9-fbc3-43de-93ad-38e97237c344
status: test
description: |
    Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn't meet the signing requirements.
references:
    - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
    - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
    - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-11
modified: 2025-12-03
tags:
    - attack.stealth
logsource:
    product: windows
    service: appxdeployment-server
detection:
    selection:
        EventID: 401
        ErrorCode: '0x80073cff' # Check ref section to learn more about this error code
    condition: selection
falsepositives:
    - Legitimate AppX packages not signed by MS used part of an enterprise.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 401
    ErrorCode: '0x80073cff'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ErrorCode`	eq	`0x80073cff`	`field:"aws::errorCode" kind:eq value:"0x80073cff"`