Potential Persistence Using Appx DebugPath

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects potential persistence mechanisms leveraging the Appx DebugPath feature in Windows. Adversaries can modify specific registry keys related to Universal Windows Platform (UWP) applications to inject a malicious DebugPath, which then executes their code when the associated application is launched. The rule specifically looks for modifications to the 'DebugPath' value within 'Classes\ActivatableClasses\Package\Microsoft.' registry paths or the default value within '\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.' paths.