Unsigned WindowsApp Executable Making Suspicious Network Connections
This rule detects unsigned executables originating from the WindowsApps directory that are making network connections to IP lookup services. This behavior can indicate a potentially malicious application attempting to identify its external IP address, possibly for command and control communication or reconnaissance. Common browsers are excluded from this detection to reduce false positives.
Microsoft Sentinel (KQL)
