Detectionmediumtest

Deployment AppX Package Was Blocked By AppLocker

Detects an appx package deployment that was blocked by AppLocker policy.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

François HubautCreated Wed Jan 116ae53108-c3a0-4bee-8f45-c7591a2c337fwindows

Log Source

Windowsappxdeployment-server

ProductWindows← raw: windows

Serviceappxdeployment-server← raw: appxdeployment-server

Detection Logic

detection:
    selection:
        EventID: 412
    condition: selection

False Positives

Unlikely, since this event notifies about blocked application deployment. Tune your applocker rules to avoid blocking legitimate applications.

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

6ae53108-c3a0-4bee-8f45-c7591a2c337f

Status

test

Level

medium

Type

Detection

Created

Wed Jan 11

Author

Path

rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_applocker_block.yml

Raw Tags

attack.defense-evasion