Windows AppX Deployment Full Trust Package Installation

Status: experimental
Severity: medium
Log source: product windows, service appxdeployment-server
Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions

Known false positives

Some legitimate applications installation which have been missed from filtering can generate fps, thus baselining and tuning is recommended before deploying to production

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204.002` User Execution: Malicious File
Defense Impairment	`T1553.005` Subvert Trust Controls: Mark-of-the-Web Bypass

Telemetry coverage

Provider	Record / event type
AppXDeployment-Server	Event ID 400: Deployment DeploymentOperation operation with target volume MountPoint on Package PackageFullName from: Path finished successfully.

Rule body

title: Windows AppX Deployment Full Trust Package Installation
id: e54279c7-4910-4e2c-902c-c56a25b549f6
status: experimental
description: Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions
references:
    - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-03
tags:
    - attack.execution
    - attack.defense-impairment
    - attack.t1204.002
    - attack.t1553.005
logsource:
    product: windows
    service: appxdeployment-server
detection:
    selection:
        EventID: 400
        HasFullTrust: true
    filter_main_legitpath:
        PackageSourceUri|startswith:
            - 'file:///C:/Program%20Files/'
            - 'file:///C:/Program%20Files%20(x86)/'
    filter_main_microsoft:
        - PackageSourceUri|startswith: 'https://go.microsoft.com/fwlink/?linkid'
        - PackageSourceUri|contains:
              - '.cdn.microsoft.com'
              - '.cdn.office.net/'
    filter_main_callerprocess:
        CallingProcess|startswith:
            - 'sysprep.exe'
            - 'svchost.exe,AppReadiness'
    filter_optional_x_update:
        PackageSourceUri|startswith: 'x-windowsupdate://'
    filter_optional_microsoftclient:
        PackageFullName|startswith: 'MicrosoftWindows.Client.'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Some legitimate applications installation which have been missed from filtering can generate fps, thus baselining and tuning is recommended before deploying to production
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    EventID: 400
    HasFullTrust: true

Stage 2: `not filter_main_*`

filter_main_legitpath:
    PackageSourceUri|startswith:
        - 'file:///C:/Program%20Files/'
        - 'file:///C:/Program%20Files%20(x86)/'
filter_main_microsoft:
    - PackageSourceUri|startswith: 'https://go.microsoft.com/fwlink/?linkid'
    - PackageSourceUri|contains:
          - '.cdn.microsoft.com'
          - '.cdn.office.net/'
filter_main_callerprocess:
    CallingProcess|startswith:
        - 'sysprep.exe'
        - 'svchost.exe,AppReadiness'

Stage 3: `not filter_optional_*`

filter_optional_x_update:
    PackageSourceUri|startswith: 'x-windowsupdate://'
filter_optional_microsoftclient:
    PackageFullName|startswith: 'MicrosoftWindows.Client.'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CallingProcess`	starts_with	`svchost.exe,AppReadiness`	`excludes:CallingProcess` `field:"CallingProcess" value:"svchost.exe,AppReadiness"`
`CallingProcess`	starts_with	`sysprep.exe`	`excludes:CallingProcess` `field:"CallingProcess" value:"sysprep.exe"`
`PackageSourceUri`	match	`.cdn.microsoft.com`	`excludes:PackageSourceUri` `field:"PackageSourceUri" value:".cdn.microsoft.com"`
`PackageSourceUri`	match	`.cdn.office.net/`	`excludes:PackageSourceUri` `field:"PackageSourceUri" value:".cdn.office.net/"`
`PackageSourceUri`	starts_with	`file:///C:/Program%20Files%20(x86)/`	`excludes:PackageSourceUri` `field:"PackageSourceUri" value:"file:///C:/Program%20Files%20(x86)/"`
`PackageSourceUri`	starts_with	`file:///C:/Program%20Files/`	`excludes:PackageSourceUri` `field:"PackageSourceUri" value:"file:///C:/Program%20Files/"`
`PackageSourceUri`	starts_with	`https://go.microsoft.com/fwlink/?linkid`	`excludes:PackageSourceUri` `field:"PackageSourceUri" value:"https://go.microsoft.com/fwlink/?linkid"`
`PackageFullName`	starts_with	`MicrosoftWindows.Client.`	`excludes:PackageFullName` `field:"PackageFullName" value:"MicrosoftWindows.Client."`
`PackageSourceUri`	starts_with	`x-windowsupdate://`	`excludes:PackageSourceUri` `field:"PackageSourceUri" value:"x-windowsupdate://"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`HasFullTrust`	eq	`true` corpus 2 (sigma 1, splunk 1)	`field:"HasFullTrust" kind:eq value:"true"`