AppX Package Installation Attempts Via AppInstaller.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects DNS queries made by "AppInstaller.EXE" when attempting to load or install an AppX package from a referenced URL. This activity is indicative of the AppInstaller being used, which is the default handler for the "ms-appinstaller" URI scheme. This can be abused by adversaries for ingress tool transfer.