Feat: susp msix/appX package installation detection

[swachchhanda000]

Summary of the Pull Request

Changelog

new: Windows AppX Deployment Full Trust Package Installation
new: Successful MSIX/AppX Package Installation
new: Windows AppX Deployment Unsigned Package Installation
new: Windows MSIX Package Support Framework AI_STUBS Execution

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[swachchhanda000]

Dependency: SigmaHQ/pySigma-validators-sigmaHQ#54

Needs this to be merged and released to fix the CI errors

[Copilot]

Pull Request Overview

This PR adds detection capabilities for suspicious MSIX/AppX package installations on Windows systems. The focus is on identifying potentially malicious package installations through various indicators including unsigned packages, full trust privileges, and Package Support Framework abuse.

Key Changes:

• Added four new Sigma detection rules targeting different aspects of MSIX/AppX package installation abuse
• Enhanced test configuration to support new field validations for appxpackaging-om logs
• Established cross-references between related detection rules across process creation, PowerShell script, and AppX packaging log sources

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/sigma_cli_conf.yml	Added exclusion for number_as_string validation for new unsigned package installation rule
tests/logsource.json	Extended appxpackaging-om log source fields to include Flags and HasFullTrust for package installation detection
proc_creation_win_powershell_install_unsigned_appx_packages.yml	Added cross-reference to new AppX packaging log-based unsigned installation detection rule
proc_creation_win_msix_ai_stub_execution.yml	New rule detecting Advanced Installer MSIX PSF component execution via AI_STUBS processes
posh_ps_install_unsigned_appx_packages.yml	Added cross-reference to new AppX packaging log-based unsigned installation detection rule
win_appxpackaging_om_unsigned_package_installation.yml	New rule detecting unsigned MSIX/AppX package installation via EventID 603 and Flags field
win_appxpackaging_om_successful_package_installation.yml	New rule providing baseline detection for any successful MSIX/AppX package installation
win_appxpackaging_om_full_trust_package_installation.yml	New rule detecting full trust MSIX/AppX package installations with elevated privileges

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.