Application Uninstalled

Description

An application has been removed. Check if it is critical.

Query · sigma

selection:
  Provider_Name: MsiInstaller
  EventID:
  - 1034
  - 11724
condition: selection

Known false positives

  • Unknown
Raw source Application Uninstalled · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Application Uninstalled
id: 570ae5ec-33dc-427c-b815-db86228ad43e
status: test
description: An application has been removed. Check if it is critical.
references:
    - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml
    - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
author: frack113
date: 2022-01-28
modified: 2022-09-17
tags:
    - attack.impact
    - attack.t1489
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'MsiInstaller'
        EventID:
            - 1034 # Windows Installer removed the product
            - 11724 # Product Removal Successful
    condition: selection
falsepositives:
    - Unknown
# Level is low as it can be very verbose, you can use the top or less 10 "Product Name" to have a quick overview
level: low

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.