AppX Package Deployment Blocked by Policy

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

This rule detects when the deployment of an AppX package is blocked by the local computer policy. This can indicate an attempt to install an unauthorized application that is being prevented by system controls. The rule specifically looks for EventIDs 441, 442, 453, and 454 from the Microsoft-Windows-AppXDeployment-Server event source.