title: AppInstaller Attempts From URL by DNS
id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a
description: AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL
status: experimental
date: 2021/11/24
author: frack113
tags:
    - attack.command_and_control
    - attack.t1105
references:
    - https://twitter.com/notwhickey/status/1333900137232523264
    - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        Image|startswith: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_
        Image|endswith: \AppInstaller.exe
    condition: selection
falsepositives:
    - Unknown
level: medium