Detection of MSIX Full Trust Package Installation

The installation of MSIX or AppX packages with the "full trust" capability allows applications to run with the user's privilege level outside of the standard AppX container restrictions. This capability is often exploited by adversaries to achieve persistence and execute code with elevated rights while bypassing sandbox controls. The AppX Deployment Server (AppxDeployment-Server) logs provide visibility into these installations, specifically via Event ID 400. Defenders must baseline legitimate software deployment pipelines to differentiate between authorized enterprise application updates and malicious package delivery. This detection logic focuses on flagging installations that do not originate from trusted Microsoft-signed update sources or standard application installation directories.

Impact

Successful installation of a malicious full-trust package results in privilege escalation or persistent execution within the user context, as the application is no longer bound by containerized security policies. This technique allows attackers to maintain stealthy presence and interact directly with the local file system and registry, potentially facilitating lateral movement or further malware deployment.

Recommendation

Deploy the Sigma rule below to monitor for suspicious full-trust package installations. Before enabling alerts in production, baseline the environment to identify legitimate internal tools or management software that may trigger this rule. Add verified internal software paths or specific signer information to the exclusion filters to reduce noise. Ensure that the AppX Deployment Server event logs are being ingested into your SIEM platform.