Potential Malicious AppX Package Installation Attempts

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•26

Detects potential installation or installation attempts of known malicious AppX packages by monitoring Windows AppXDeployment-Server Event IDs 400 and 401, specifically looking for a known malicious package full name.