Detectionmediumtest

Deployment Of The AppX Package Was Blocked By The Policy

Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an AppX package deployment was blocked by a policy: - Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy - Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy." - Event ID 453: Package blocked by a platform policy. - Event ID 454: Package blocked by a platform policy.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Wed Jan 11e021bbb5-407f-41f5-9dc9-1864c45a7a51windows

Log Source

Windowsappxdeployment-server

ProductWindows← raw: windows

Serviceappxdeployment-server← raw: appxdeployment-server

Detection Logic

detection:
    selection:
        EventID:
            - 441 # The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
            - 442 # Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
            - 453 # Package blocked by a platform policy
            - 454 # Package blocked by a platform policy
    condition: selection