Uncommon AppX Package Location
This rule detects the addition of an AppX package to the "to be processed" pipeline when the package is located in an uncommon directory. AppX packages are a Windows application packaging format. Adversaries may leverage this mechanism to deploy malicious applications or achieve persistence. The rule specifically filters out common and legitimate installation paths and sources, such as Program Files, WindowsApps, SystemApps, and Microsoft-related CDN URLs, to reduce false positives. Detection is based on Event ID 854 from the AppXDeployment-Server log source.
Sigma
