security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 45 Packages Projects Releases Wiki Activity

Merge PR #5741 from @swachchhanda000 - Add Splunk Rules for MSIX/AppX

Browse Source 
new: Successful MSIX/AppX Package Installation
new: Windows AppX Deployment Full Trust Package Installation
new: Windows AppX Deployment Unsigned Package Installation
new: Windows MSIX Package Support Framework AI_STUBS Execution

---------

Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
This commit is contained in:
Swachchhanda Shrawan Poudel
2026-01-24 21:49:41 +05:45
committed by GitHub
parent c0af81c9d2
commit 77f4b0b2ec
8 changed files with 136 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/logsource.json
+1 -1
View File
@@ -91,7 +91,7 @@
"msexchange-management":[],
"applocker":[],
"vhdmp":[],
"appxdeployment-server":["Path", "AppId", "FilePath", "ErrorCode", "DeploymentOperation", "PackageFullName", "PackageSourceUri", "PackageDisplayName", "CallingProcess"],
"appxdeployment-server":["Path", "AppId", "FilePath", "ErrorCode", "DeploymentOperation", "PackageFullName", "PackageSourceUri", "PackageDisplayName", "CallingProcess","Flags", "HasFullTrust"],
"appxpackaging-om":["subjectName"],
"lsa-server":["TargetUserSid", "TargetUserName", "TargetDomainName", "TargetLogonId", "TargetLogonGuid", "EventOrginal", "EventCountTotal", "SidList"],
"dns-client":["QueryName", "QueryType", "QueryOptions", "QueryStatus", "QueryResults", "NetworkIndex", "InterfaceIndex", "Status", "ClientPID", "QueryBlob", "DnsServerIpAddress", "ResponseStatus", "SendBlob", "SendBlobContext", "AddressLength", "Address"],
tests/sigma_cli_conf.yml
+1
View File
@@ -56,6 +56,7 @@ exclusions:
5c84856b-55a5-45f1-826f-13f37250cf4e: number_as_string
749c9f5e-b353-4b90-a9c1-05243357ca4b: number_as_string
85b88e05-dadc-430b-8a9e-53ff1cd30aae: number_as_string
9a025188-6f2d-42f8-bb2f-d3a83d24a5af: number_as_string
# specific_instead_of_generic_logsource
23b71bc5-953e-4971-be4c-c896cda73fc2: specific_instead_of_generic_logsource
693a44e9-7f26-4cb6-b787-214867672d3a: specific_instead_of_generic_logsource