Rule Info
Name
Potentially Suspicious Script File Created In WindowsApps Directory
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the creation of a file with a script extension (ps1, vbs, bat) in the "WindowsApps" directory.
This could be a sign of a rogue MSIX package.
Date
2024-06-06 00:00:00
Modified
None
Id
d36faa80-36d7-44fd-afc2-9080298cefca
Tags
attack.persistence attack.t1546 attack.defense_evasion attack.t1027
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR