Query: alert when Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside nor
Matching passage: Sigma rule: Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside nor. Logsource: windows / appxdeployment-server. Rule: title: Windows AppX Deployment Full Trust Package Installation id: e54279c7-4910-4e2c-902c-c56a25b549f6 status: experimental description: Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions references: - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-03 tags: - attack.execution - attack.defense-impairment - attack.t1204.002 - attack.t1553.005 logsource: product: windows service: appxdeployment-server detection: selection: EventID: 400 HasFullTrust: true filter_main_legitpath: PackageSourceUri|startswith: - file:///C:/Program%20Files/ - file:///C:/Program%20Files%20(x86)/ filter_main_microsoft: - PackageSourceUri|startswith: https://go.microsoft.com/fwlink/?linkid - PackageSourceUri|contains: - .cdn.microsoft.com - .cdn.office.net/ filter_main_callerprocess: CallingProcess|startswith: - sysprep.exe - svchost.exe,AppReadiness filter_optional_x_update: PackageSourceUri|startswith: x-windowsupdate:// filter_optional_microsoftclient: PackageFullName|startswith: MicrosoftWindows.Client. condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some legitimate applications installation which have been missed from filtering can generate fps, thus baselining and tuning is recommended before deploying to production level: medium
Near-miss passage: Sigma rule: Detects download of certain file types from hosts with dynamic DNS names (selected list). Logsource: proxy. Rule: title: Download from Suspicious Dyndns Hosts id: 195c1119-ef07-4909-bb12-e66f5e07bf3c status: test description: Detects download of certain file types from hosts with dynamic DNS names (selected list) references: - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats author: Florian Roth (Nextron Systems) date: 2017-11-08 modified: 2023-05-18 tags: - attack.command-and-control - attack.t1105 - attack.t1568 logsource: category: proxy detection: selection: c-uri-extension: - exe - vbs - bat - rar - ps1 - doc - docm - xls - xlsm - pptm - rtf - hta - dll - ws - wsf - sct - zip cs-host|endswith: - .hopto.org - .no-ip.org - .no-ip.info - .no-ip.biz - .no-ip.com - .noip.com - .ddns.name - .myftp.org - .myftp.biz - .serveblog.net - .servebeer.com - .servemp3.com - .serveftp.com - .servequake.com - .servehalflife.com - .servehttp.com - .servegame.com - .servepics.com - .myvnc.com - .ignorelist.com - .jkub.com - .dlinkddns.com - .jumpingcrab.com - .ddns.info - .mooo.com - .dns-dns.com - .strangled.net - .adultdns.net - .craftx.biz - .ddns01.com - .dns53.biz - .dnsapi.info - .dnsd.info - .dnsdynamic.com - .dnsdynamic.net - .dnsget.org - .fe100.net - .flashserv.net - .ftp21.net - .http01.com - .http80.info - .https443.com - .imap01.com - .kadm5.com - .mysq1.net - .ns360.info - .ntdll.net - .ole32.com - .proxy8080.com - .sql01.com - .ssh01.com - .ssh22.net - .tempors.com - .tftpd.net - .ttl60.com - .ttl60.org - .user32.com - .voip01.com - .wow64.net - .x64.me - .xns01.com - .dyndns.org - .dyndns.info - .dyndns.tv - .dyndns-at-home.com - .dnsomatic.com - .zapto.org - .webhop.net - .25u.com - .slyip.net condition: selection falsepositives: - Software downloads level: medium