All Detections

Potential File Download Via MS-AppInstaller Protocol Handler

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 2025022

Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>"

Sigma