Potential File Download Via MS-AppInstaller Protocol Handler

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•18

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE. The downloaded files are temporarily stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>". This technique can be used for defense evasion and execution.