Query: Sigma YAML for windows / appxdeployment-server
Matching passage: Sigma rule: Detects potential installation or installation attempts of known malicious appx packages. Logsource: windows / appxdeployment-server. Rule: title: Potential Malicious AppX Package Installation Attempts id: 09d3b48b-be17-47f5-bf4e-94e7e75d09ce status: test description: Detects potential installation or installation attempts of known malicious appx packages references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ - https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2023-01-12 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: - 400 - 401 PackageFullName|contains: 3669e262-ec02-4e9d-bcb4-3d008b4afac9 condition: selection falsepositives: - Rare occasions where a malicious package uses the exact same name and version as a legitimate application. level: medium
Near-miss passage: Sigma rule: Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or. Logsource: windows / process_creation. Rule: title: Suspicious Windows Service Tampering id: ce72ef99-22f1-43d4-8695-419dcb5d9330 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete - id: 6783aa9e-0dc3-49d4-a94a-8b39c5fd700b type: obsolete - id: 7fd4bb39-12d0-45ab-bb36-cebabc73dc7b type: obsolete status: test description: 'Detects the usage of binaries such as ''net'', ''sc'' or ''powershell'' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts ' references: - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems) date: 2022-09-01 modified: 2025-08-27 tags: - attack.impact - attack.defense-impairment - attack.t1489 - attack.t1685 logsource: category: process_creation product: windows detection: selection_tools_img: - OriginalFileName: - net.exe - net1.exe - PowerShell_ISE.EXE - PowerShell.EXE - psservice.exe - pwsh.dll - sc.exe - wmic.exe - Image|endswith: - \net.exe - \net1.exe - \PowerShell_ISE.EXE - \powershell.exe - \PsService.exe - \PsService64.exe - \pwsh.exe - \sc.exe - \wmic.exe selection_tools_cli: - CommandLine|contains: - ' delete ' - .delete() - ' pause ' - ' stop ' - 'Stop-Service ' - 'Remove-Service ' - CommandLine|contains|all: - config - start=disabled selection_services: CommandLine|contains: - 143Svc - Acronis VSS Provider - AcronisAgent - AcrSch2Svc - AdobeARMservice - AHS Service - Antivirus - Apache4 - ARSM - aswBcc - AteraAgent - Avast Business Console Client Antivirus Service - avast! Antivirus - AVG Antivirus - avgAdminClient - AvgAdminServer - AVP1 - BackupExec - bedbg - BITS - BrokerInfrastructure - CASLicenceServer - CASWebServer - Client Agent 7.60 - Core Browsing Protection - Core Mail Protection -