XBAP Execution From Uncommon Locations Via PresentationHost.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files and bypass application allowlisting.