Potentially Suspicious Windows App Activity

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution