Application Uninstalled

Title: Application Uninstalled
Status: test
Description:An application has been removed. Check if it is critical.
References:
  -https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml
  -https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
Author: frack113
Date: 2022-01-28
modified:2022-09-17
Tags:

• -'attack.impact'
• -'attack.t1489'

Logsource:

• product: windows
• service: application

Detection:
  selection:
    Provider_Name: 'MsiInstaller'
    EventID:
      -'1034'
      -'11724'

  condition:selection
Falsepositives:
  -Unknown
Level: low