Suspicious Digital Signature Of AppX Package

calendar Aug 12, 2024 · attack.defense-evasion attack.execution  ·
Share on: linkedin copy

Detects execution of AppX packages with known suspicious or malicious signature

Sigma rule (View on GitHub)

 1title: Suspicious Digital Signature Of AppX Package
 2id: b5aa7d60-c17e-4538-97de-09029d6cd76b
 3status: test
 4description: Detects execution of AppX packages with known suspicious or malicious signature
 5references:
 6    - Internal Research
 7    - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
 8author: Nasreddine Bencherchali (Nextron Systems)
 9date: 2023-01-16
10tags:
11    - attack.defense-evasion
12    - attack.execution
13logsource:
14    product: windows
15    service: appxpackaging-om
16detection:
17    selection:
18        EventID: 157
19        # Add more known suspicious/malicious certificates used in different attacks
20        subjectName: 'CN=Foresee Consulting Inc., O=Foresee Consulting Inc., L=North York, S=Ontario, C=CA, SERIALNUMBER=1004913-1, OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization'
21    condition: selection
22falsepositives:
23    - Unknown
24level: medium

References

Related rules

to-top