Suspicious Remote AppX Package Locations
This rule detects the addition of an AppX package to the processing pipeline where the package's source path contains domains commonly associated with file sharing, code hosting, or temporary storage services. Adversaries often leverage these services to host malicious payloads, including AppX packages, to bypass traditional security controls or to deliver malware. The rule specifically looks for EventID 854 from the 'AppXDeployment-Server' log source and checks if the 'Path' field contains any of the listed suspicious domains.
Sigma
