Windows AppX Deployment Full Trust Package Installation

 1title: Windows AppX Deployment Full Trust Package Installation
 2id: e54279c7-4910-4e2c-902c-c56a25b549f6
 3status: experimental
 4description: Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions
 5references:
 6    - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
 7author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
 8date: 2025-11-03
 9tags:
10    - attack.defense-evasion
11    - attack.execution
12    - attack.t1204.002
13    - attack.t1553.005
14logsource:
15    product: windows
16    service: appxdeployment-server
17detection:
18    selection:
19        EventID: 400
20        HasFullTrust: true
21    filter_main_legitpath:
22        PackageSourceUri|startswith:
23            - 'file:///C:/Program%20Files/'
24            - 'file:///C:/Program%20Files%20(x86)/'
25    filter_main_microsoft:
26        - PackageSourceUri|startswith: 'https://go.microsoft.com/fwlink/?linkid'
27        - PackageSourceUri|contains:
28              - '.cdn.microsoft.com'
29              - '.cdn.office.net/'
30    filter_main_callerprocess:
31        CallingProcess|startswith:
32            - 'sysprep.exe'
33            - 'svchost.exe,AppReadiness'
34    filter_optional_x_update:
35        PackageSourceUri|startswith: 'x-windowsupdate://'
36    filter_optional_microsoftclient:
37        PackageFullName|startswith: 'MicrosoftWindows.Client.'
38    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
39falsepositives:
40    - Some legitimate applications installation which have been missed from filtering can generate fps, thus baselining and tuning is recommended before deploying to production
41level: medium