Query: detection rule: Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon loc
Matching passage: Sigma rule: Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon loc. Logsource: windows / appxdeployment-server. Rule: title: AppX Located in Uncommon Directory Added to Deployment Pipeline id: c977cb50-3dff-4a9f-b873-9290f56132f1 status: test description: 'Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations. ' references: - Internal Research - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2025-12-03 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: 854 filter_main_generic: Path|contains: - :/Program%20Files - :/Windows/System32/ - :\Program Files (x86)\ - :\Program Files\ - :\Windows\ImmersiveControlPanel\ - :\Windows\PrintDialog\ - :\Windows\SystemApps\ - AppData/Local/Temp/WinGet/Microsoft.Winget.Source - x-windowsupdate:// filter_main_specific: Path|contains: - https://installer.teams.static.microsoft/ - https://res.cdn.office.net - https://statics.teams.cdn.live.net/ - https://statics.teams.cdn.office.net/ - microsoft.com filter_optional_onedrive: Path|contains: AppData\Local\Microsoft\OneDrive\ filter_optional_winget: Path|contains: - AppData/Local/Temp/WinGet/Microsoft.Winget.Source - AppData\Local\Temp\WinGet\Microsoft.Winget.Source filter_optional_x_windowsupdate: Path|contains: x-windowsupdate:// condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification. Logsource: windows / registry_set. Rule: title: Bypass UAC Using Event Viewer id: 674202d0-b22a-4af4-ae5f-2eda1f3da1af status: test description: Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification references: - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd author: frack113 date: 2022-01-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: _Classes\mscfile\shell\open\command\(Default) filter: Details|startswith: '%SystemRoot%\system32\mmc.exe "%1" %' condition: selection and not filter falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer/info.yml simulation: - type: atomic-red-team name: Bypass UAC using Event Viewer (cmd) technique: T1548.002 atomic_guid: 5073adf8-9a50-4bd9-b298-a9bd2ead8af9