AppX Located in Uncommon Directory Added to Deployment Pipeline
Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations.
Detection logic
Detection requirements
- Log source product
- windows
- Log source service
- appxdeployment_server
Known benign triggers
- Unknown
MITRE ATT&CK mappings
Not mapped to ATT&CK.
References
| Reference | Cited by |
|---|---|
| learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting | 9from 2 sources |
| news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ | 6 |
| www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ | 9 |
From the source
- At source
- Open at source
- Upstream identifier
- c977cb50-3dff-4a9f-b873-9290f56132f1
- Tagged by the source as
- attack.stealth
Licence
- Published under
- Detection Rule License 1.1Read the licence
- Attribution
- Required
Authorship
- Published
- Aug 26, 2026
- Version
- 1