win_appxdeployment_server_susp_package_locations.yml

title: Suspicious AppX Package Locations
id: 5cdeaf3d-1489-477c-95ab-c318559fc051
status: test
description: Detects an appx package added the pipeline of the "to be processed" packages which is located in suspicious locations
references:
    - Internal Research
    - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
    - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
    - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023/01/11
tags:
    - attack.defense_evasion
logsource:
    product: windows
    service: appxdeployment-server
detection:
    selection:
        EventID: 854
        Path|contains:
            # Paths can be written using forward slash if the "file://" protocol is used
            - 'C:\Users\Public\'
            - '/users/public/'
            - 'C:\PerfLogs\'
            - 'C:/perflogs/'
            - '\Desktop\'
            - '/desktop/'
            - '\Downloads\'
            - '/Downloads/'
            - 'C:\Windows\Temp\'
            - 'C:/Windows/Temp/'
            - '\AppdData\Local\Temp\'
            - '/AppdData/Local/Temp/'
    condition: selection
falsepositives:
    - Unknown
level: high