Sigma rule: Potentially Suspicious Windows App Activity

Rule

Title

Potentially Suspicious Windows App Activity

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-01-12

Modified

2025-10-07

File

rules/windows/process_creation/proc_creation_win_susp_appx_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution

Log source

product

windows

category

process_creation

Detection

selection_parent:
    # GrandParentImage|endswith: '\sihost.exe'
    ParentImage|contains: 'C:\Program Files\WindowsApps\'
selection_susp_img:
    Image|endswith:
        # You can add more LOLBINs
        - '\cmd.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\powershell.exe'
        - '\powershell_ise.exe'
        - '\pwsh.exe'
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\wscript.exe'
selection_susp_cli:
    # You can add more potentially suspicious keywords
    CommandLine|contains:
        - 'cmd /c'
        - 'Invoke-'
        - 'Base64'
filter_optional_terminal:
    ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal'
    ParentImage|endswith: '\WindowsTerminal.exe'
    # Note: to avoid FP add the default shells and profiles that your WT integrates
    Image|endswith:
        - '\powershell.exe'
        - '\cmd.exe'
        - '\pwsh.exe'
filter_optional_sysinternals:
    ParentImage|startswith: 'C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite'
    Image|endswith: '\cmd.exe'
condition: selection_parent and 1 of selection_susp_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate packages that make use of external binaries such as Windows Terminal

Tags

• attack.stealth

References

• https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
• https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_appx_execution.yml