Skip to content

Commit 34d8db9

Browse files
MHaggisMHaggis
committed
updates
1 parent 2600cb1 commit 34d8db9

5 files changed

+51
-36
lines changed

‎data_sources/windows_event_log_appxdeployment_server_400.yml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,23 @@ fields:
4747
- dest
4848
- host
4949
- user_id
50+
output_fields:
51+
- _time
52+
- CallingProcess
53+
- dest
54+
- dvc
55+
- EventCode
56+
- HasFullTrust
57+
- host
58+
- IsCentennial
59+
- PackageDisplayName
60+
- PackageFullName
61+
- PackageSourceUri
62+
- Path
63+
- ProcessID
64+
- user_id
5065
references:
5166
- https://learn.microsoft.com/en-us/windows/msix/desktop/desktop-to-uwp-behind-the-scenes
5267
- https://learn.microsoft.com/en-us/windows/msix/package/package-identity
5368
- https://redcanary.com/blog/threat-intelligence/msix-installers/
54-
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-AppXDeployment-Server' Guid='{3f471139-acb7-4a01-b7a7-ff5da4ba2d43}'/><EventID>400</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>2</Opcode><Keywords>0x4000000000000001</Keywords><TimeCreated SystemTime='2025-08-06T16:21:23.2487289Z'/><EventRecordID>16489</EventRecordID><Correlation ActivityID='{df6fb197-9b7b-0003-0230-a39ded06dc01}'/><Execution ProcessID='5820' ThreadID='5960'/><Channel>Microsoft-Windows-AppXDeploymentServer/Operational</Channel><Computer>HaagMSIX</Computer><Security UserID='S-1-5-21-2568234075-4274264167-1034506908-500'/></System><EventData><Data Name='DeploymentOperation'>6</Data><Data Name='PackageFullName'>Microsoft.DesktopAppInstaller_2025.717.1857.0_neutral_~_8wekyb3d8bbwe</Data><Data Name='Path'> (AppxBundleManifest.xml) </Data><Data Name='MountPoint'>C:</Data><Data Name='TargetPlatform'>0x0</Data><Data Name='SystemVolume'>true</Data><Data Name='StorageId'>\\?\Volume{de26f417-916d-40a6-aaa9-9675b36f2d21}</Data><Data Name='IsCentennial'>false</Data><Data Name='PackageType'>0x8</Data><Data Name='IsPackageEncrypted'>false</Data><Data Name='DeploymentOptions'>0x40040040</Data><Data Name='IsStreamingPackage'>false</Data><Data Name='IsInRelatedSet'>false</Data><Data Name='IsPackageUsingBDC'>false</Data><Data Name='MainPackageFamilyName'>NULL</Data><Data Name='CallingProcess'>sihost.exe</Data><Data Name='IsOptional'>false</Data><Data Name='PackageFlags'>0x400</Data><Data Name='PackageFlags2'>0x800</Data><Data Name='HasWin32alacarte'>false</Data><Data Name='HasFullTrust'>false</Data><Data Name='ExternalLocation'></Data><Data Name='PackageSourceUri'>x-windowsupdate://05C4B27B-6E00-4A05-9B94-15C77E54E690/F855810C-9F77-45FF-A0F5-CD0FEAA945C6/508bfda4dcfb262c40e6f5d8e8811b3f47ee98a2</Data><Data Name='PackageDisplayName'> </Data></EventData></Event>
69+
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-AppXDeployment-Server' Guid='{3f471139-acb7-4a01-b7a7-ff5da4ba2d43}'/><EventID>400</EventID><Version>0</Version><Level>4</Level><Task>3</Task><Opcode>2</Opcode><Keywords>0x4000000000000001</Keywords><TimeCreated SystemTime='2025-08-06T16:21:23.2487289Z'/><EventRecordID>16489</EventRecordID><Correlation ActivityID='{df6fb197-9b7b-0003-0230-a39ded06dc01}'/><Execution ProcessID='5820' ThreadID='5960'/><Channel>Microsoft-Windows-AppXDeploymentServer/Operational</Channel><Computer>HaagMSIX</Computer><Security UserID='S-1-5-21-2568234075-4274264167-1034506908-500'/></System><EventData><Data Name='DeploymentOperation'>6</Data><Data Name='PackageFullName'>Microsoft.DesktopAppInstaller_2025.717.1857.0_neutral_~_8wekyb3d8bbwe</Data><Data Name='Path'> (AppxBundleManifest.xml) </Data><Data Name='MountPoint'>C:</Data><Data Name='TargetPlatform'>0x0</Data><Data Name='SystemVolume'>true</Data><Data Name='StorageId'>\\?\Volume{de26f417-916d-40a6-aaa9-9675b36f2d21}</Data><Data Name='IsCentennial'>false</Data><Data Name='PackageType'>0x8</Data><Data Name='IsPackageEncrypted'>false</Data><Data Name='DeploymentOptions'>0x40040040</Data><Data Name='IsStreamingPackage'>false</Data><Data Name='IsInRelatedSet'>false</Data><Data Name='IsPackageUsingBDC'>false</Data><Data Name='MainPackageFamilyName'>NULL</Data><Data Name='CallingProcess'>sihost.exe</Data><Data Name='IsOptional'>false</Data><Data Name='PackageFlags'>0x400</Data><Data Name='PackageFlags2'>0x800</Data><Data Name='HasWin32alacarte'>false</Data><Data Name='HasFullTrust'>false</Data><Data Name='ExternalLocation'></Data><Data Name='PackageSourceUri'>x-windowsupdate://05C4B27B-6E00-4A05-9B94-15C77E54E690/F855810C-9F77-45FF-A0F5-CD0FEAA945C6/508bfda4dcfb262c40e6f5d8e8811b3f47ee98a2</Data><Data Name='PackageDisplayName'> </Data></EventData></Event>

‎detections/endpoint/windows_appx_deployment_full_trust_package_installation.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ description: The following analytic detects the installation of MSIX/AppX packag
99
data_source:
1010
- Windows Event Log AppXDeployment-Server 400
1111
search: '`wineventlog_appxdeploymentserver` EventCode=400 HasFullTrust="true"
12-
| stats count min(_time) as firstTime max(_time) as lastTime values(PackageFullName) as PackageFullName values(Path) as PackagePath values(PackageSourceUri) as PackageSourceUri values(PackageDisplayName) as PackageDisplayName values(CallingProcess) as CallingProcess values(IsCentennial) as IsCentennial by host EventCode HasFullTrust user_id
12+
| stats count min(_time) as firstTime max(_time) as lastTime values(PackageFullName) as PackageFullName values(Path) as PackagePath values(PackageSourceUri) as PackageSourceUri values(PackageDisplayName) as PackageDisplayName values(CallingProcess) as CallingProcess values(IsCentennial) as IsCentennial by dvc EventCode HasFullTrust user_id | rename dvc as dest
1313
| `security_content_ctime(firstTime)`
1414
| `security_content_ctime(lastTime)`
1515
| `windows_appx_deployment_full_trust_package_installation_filter`'
@@ -22,21 +22,21 @@ references:
2222
- https://learn.microsoft.com/en-us/windows/msix/package/package-identity
2323
- https://attack.mitre.org/techniques/T1553/005/
2424
drilldown_searches:
25-
- name: View the detection results for - "$host$"
26-
search: '%original_detection_search% | search host = "$host$"'
25+
- name: View the detection results for - "$dest$"
26+
search: '%original_detection_search% | search dest = "$dest$"'
2727
earliest_offset: $info_min_time$
2828
latest_offset: $info_max_time$
29-
- name: View risk events for the last 7 days for - "$host$"
30-
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$")
29+
- name: View risk events for the last 7 days for - "$dest$"
30+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
3131
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
3232
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
3333
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
3434
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
3535
| `security_content_ctime(lastTime)`'
3636
earliest_offset: $info_min_time$
3737
latest_offset: $info_max_time$
38-
- name: Look for related PowerShell activity from the same host
39-
search: '`powershell` EventCode=4104 host="$host$" | stats count by ScriptBlockText'
38+
- name: Look for related PowerShell activity from the same dest
39+
search: '`powershell` EventCode=4104 dest="$dest$" | stats count by ScriptBlockText'
4040
earliest_offset: $info_min_time$
4141
latest_offset: $info_max_time$
4242
tags:

‎detections/endpoint/windows_appx_deployment_package_installation_success.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ description: This analytic detects successful MSIX/AppX package installations on
99
data_source:
1010
- Windows Event Log AppXDeployment-Server 854
1111
search: '`wineventlog_appxdeploymentserver` EventCode=854
12-
| stats count min(_time) as firstTime max(_time) as lastTime values(Path) as PackagePath by host EventCode user_id
12+
| stats count min(_time) as firstTime max(_time) as lastTime values(Path) as PackagePath by dvc EventCode user_id | rename dvc as dest
1313
| `security_content_ctime(firstTime)`
1414
| `security_content_ctime(lastTime)`
1515
| `windows_appx_deployment_package_installation_success_filter`'
@@ -20,22 +20,22 @@ references:
2020
- https://www.appdeploynews.com/packaging-types/msix/troubleshooting-an-msix-package/
2121
- https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html
2222
drilldown_searches:
23-
- name: View the detection results for - "$host$"
24-
search: '%original_detection_search% | search host = "$host$"'
23+
- name: View the detection results for - "$dest$"
24+
search: '%original_detection_search% | search dest = "$dest$"'
2525
earliest_offset: $info_min_time$
2626
latest_offset: $info_max_time$
27-
- name: View related unsigned package installations for - "$host$"
28-
search: 'source="XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational" EventCode=603 Flags="8388608" host="$host$"'
27+
- name: View related unsigned package installations for - "$dest$"
28+
search: 'source="XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational" EventCode=603 Flags="8388608" host="$dest$"'
2929
earliest_offset: $info_min_time$
3030
latest_offset: $info_max_time$
31-
- name: View related full trust package installations for - "$host$"
32-
search: 'source="XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational" EventCode=400 HasFullTrust="true" host="$host$"'
31+
- name: View related full trust package installations for - "$dest$"
32+
search: 'source="XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational" EventCode=400 HasFullTrust="true" host="$dest$"'
3333
earliest_offset: $info_min_time$
3434
latest_offset: $info_max_time$
3535
rba:
36-
message: A MSIX/AppX package $PackagePath$ was successfully installed on $host$ by user $user_id$.
36+
message: A MSIX/AppX package $PackagePath$ was successfully installed on $dest$ by user $user_id$.
3737
risk_objects:
38-
- field: host
38+
- field: dest
3939
type: system
4040
score: 10
4141
threat_objects:

‎detections/endpoint/windows_appx_deployment_unsigned_package_installation.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ description: The following analytic detects attempts to install unsigned MSIX/Ap
99
data_source:
1010
- Windows Event Log AppXDeployment-Server 855
1111
search: '`wineventlog_appxdeploymentserver` EventCode=603 Flags="8388608"
12-
| stats count min(_time) as firstTime max(_time) as lastTime values(Path) as Path values(CallingProcess) as CallingProcess by host EventCode Flags user_id
12+
| stats count min(_time) as firstTime max(_time) as lastTime values(Path) as file_name values(CallingProcess) as CallingProcess by dvc EventCode Flags user_id | rename dvc as dest
1313
| `security_content_ctime(firstTime)`
1414
| `security_content_ctime(lastTime)`
1515
| `windows_appx_deployment_unsigned_package_installation_filter`'
@@ -21,31 +21,31 @@ references:
2121
- https://redcanary.com/blog/threat-intelligence/msix-installers/
2222
- https://attack.mitre.org/techniques/T1553/005/
2323
drilldown_searches:
24-
- name: View the detection results for - "$host$"
25-
search: '%original_detection_search% | search host = "$host$"'
24+
- name: View the detection results for - "$dest$"
25+
search: '%original_detection_search% | search dest = "$dest$"'
2626
earliest_offset: $info_min_time$
2727
latest_offset: $info_max_time$
28-
- name: View risk events for the last 7 days for - "$host$"
29-
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$")
28+
- name: View risk events for the last 7 days for - "$dest$"
29+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
3030
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
3131
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
3232
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
3333
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
3434
| `security_content_ctime(lastTime)`'
3535
earliest_offset: $info_min_time$
3636
latest_offset: $info_max_time$
37-
- name: Look for related PowerShell activity from the same host
38-
search: '`powershell` EventCode=4104 host="$host$" ScriptBlockText="*Add-AppxPackage*" OR ScriptBlockText="*Add-AppPackage*" | stats count by ScriptBlockText'
37+
- name: Look for related PowerShell activity from the same dest
38+
search: '`powershell` EventCode=4104 dest="$dest$" ScriptBlockText="*Add-AppxPackage*" OR ScriptBlockText="*Add-AppPackage*" | stats count by ScriptBlockText'
3939
earliest_offset: $info_min_time$
4040
latest_offset: $info_max_time$
4141
rba:
42-
message: Unsigned MSIX/AppX package $Path$ installation attempted on $host$ by user $user_id$ using $CallingProcess$
42+
message: Unsigned MSIX/AppX package $Path$ installation attempted on $dest$ by user $user_id$ using $CallingProcess$
4343
risk_objects:
44-
- field: host
44+
- field: dest
4545
type: system
4646
score: 65
4747
threat_objects:
48-
- field: Path
48+
- field: file_name
4949
type: file_name
5050
tags:
5151
analytic_story:

‎detections/endpoint/developer_signed_msix_package_installation.yml‎ renamed to ‎detections/endpoint/windows_developer_signed_msix_package_installation.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Developer-Signed MSIX Package Installation
1+
name: Windows Developer-Signed MSIX Package Installation
22
id: 2c0427aa-982c-4e97-bc33-bddeda4fd095
33
version: 1
44
date: '2025-08-05'
@@ -10,10 +10,10 @@ data_source:
1010
- Windows Event Log AppXDeployment-Server 855
1111
search: '`wineventlog_appxdeploymentserver` EventCode=855
1212
NOT PackageMoniker IN ("*8wekyb3d8bbwe*","*cw5n1h2txyewy*")
13-
| stats count min(_time) as firstTime max(_time) as lastTime values(PackageMoniker) as PackageMoniker by host EventCode user_id
13+
| stats count min(_time) as firstTime max(_time) as lastTime values(PackageMoniker) as PackageMoniker by dvc EventCode user_id | rename dvc as dest
1414
| `security_content_ctime(firstTime)`
1515
| `security_content_ctime(lastTime)`
16-
| `developer_signed_msix_package_installation_filter`'
16+
| `windows_developer_signed_msix_package_installation_filter`'
1717
how_to_implement: To implement this detection, you need to be collecting Windows Event logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel. In Splunk, this typically requires the Windows TA and configuration to collect from this specific channel. Ensure your Windows event collection is properly configured to capture EventCode 855 from the Microsoft-Windows-AppXDeploymentServer/Operational log.
1818
known_false_positives: Legitimate developer-signed applications that are not from the Microsoft Store will trigger this detection. Organizations should maintain a baseline of expected developer-signed applications in their environment and tune the detection accordingly. Common legitimate developer-signed applications include in-house developed applications and some third-party applications that are not distributed through the Microsoft Store.
1919
references:
@@ -22,12 +22,12 @@ references:
2222
- https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html
2323
- https://redcanary.com/blog/threat-detection/code-signing-certificates/
2424
drilldown_searches:
25-
- name: View the detection results for - "$host$"
26-
search: '%original_detection_search% | search host = "$host$"'
25+
- name: View the detection results for - "$dest$"
26+
search: '%original_detection_search% | search dest = "$dest$"'
2727
earliest_offset: $info_min_time$
2828
latest_offset: $info_max_time$
29-
- name: View risk events for the last 7 days for - "$host$"
30-
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$")
29+
- name: View risk events for the last 7 days for - "$dest$"
30+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
3131
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
3232
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
3333
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
@@ -36,9 +36,9 @@ drilldown_searches:
3636
earliest_offset: $info_min_time$
3737
latest_offset: $info_max_time$
3838
rba:
39-
message: A developer-signed MSIX package "$PackageMoniker$" was installed on $host$ by user $user_id$.
39+
message: A developer-signed MSIX package "$PackageMoniker$" was installed on $dest$ by user $user_id$.
4040
risk_objects:
41-
- field: host
41+
- field: dest
4242
type: system
4343
score: 40
4444
threat_objects:

0 commit comments

Comments
 (0)