Potentially Suspicious Windows App Activity

Hunt Hypothesis

Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue “.appx” package installation/execution

Detection Rule

Sigma (Original)

title: Potentially Suspicious Windows App Activity
id: f91ed517-a6ba-471d-9910-b3b4a398c0f3
status: test
description: Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution
references:
    - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
    - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-12
modified: 2025-10-07
tags:
    - attack.stealth
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        # GrandParentImage|endswith: '\sihost.exe'
        ParentImage|contains: 'C:\Program Files\WindowsApps\'
    selection_susp_img:
        Image|endswith:
            # You can add more LOLBINs
            - '\cmd.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
    selection_susp_cli:
        # You can add more potentially suspicious keywords
        CommandLine|contains:
            - 'cmd /c'
            - 'Invoke-'
            - 'Base64'
    filter_optional_terminal:
        ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal'
        ParentImage|endswith: '\WindowsTerminal.exe'
        # Note: to avoid FP add the default shells and profiles that your WT integrates
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
    filter_optional_sysinternals:
        ParentImage|startswith: 'C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite'
        Image|endswith: '\cmd.exe'
    condition: selection_parent and 1 of selection_susp_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate packages that make use of external binaries such as Windows Terminal
level: medium

KQL (Azure Sentinel)

imProcessCreate
| where (ParentProcessName contains "C:\\Program Files\\WindowsApps\\" or ActingProcessName contains "C:\\Program Files\\WindowsApps\\") and ((TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\mshta.exe" or TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\powershell_ise.exe" or TargetProcessName endswith "\\pwsh.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\wscript.exe") or (TargetProcessCommandLine contains "cmd /c" or TargetProcessCommandLine contains "Invoke-" or TargetProcessCommandLine contains "Base64")) and (not((((ParentProcessName contains ":\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal" or ActingProcessName contains ":\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal") and (ParentProcessName endswith "\\WindowsTerminal.exe" or ActingProcessName endswith "\\WindowsTerminal.exe") and (TargetProcessName endswith "\\powershell.exe" or TargetProcessName endswith "\\cmd.exe" or TargetProcessName endswith "\\pwsh.exe")) or ((ParentProcessName startswith "C:\\Program Files\\WindowsApps\\Microsoft.SysinternalsSuite" or ActingProcessName startswith "C:\\Program Files\\WindowsApps\\Microsoft.SysinternalsSuite") and TargetProcessName endswith "\\cmd.exe"))))

Required Data Sources

False Positive Guidance

• Legitimate packages that make use of external binaries such as Windows Terminal

References

• https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
• https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
• SigmaHQ Rule