Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory.

Read More

Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations.

Read More

Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn't meet the signing requirements.

Read More

Detects an appx package deployment that was blocked by AppLocker policy.

Read More

Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an AppX package deployment was blocked by a policy:

• Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
• Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
• Event ID 453: Package blocked by a platform policy.
• Event ID 454: Package blocked by a platform policy.

Read More

Detects potential installation or installation attempts of known malicious appx packages

Read More

Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain.

Read More

Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions

Read More

Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events

Read More