Windows Store Installs
This query displays all applications installed from the Microsoft Store on a machine. It extracts the package name from the file path and groups the results by computer name and package base. Also features the ability to filter out known good file paths and packages to reduce noise in the results.
CQL · Falcon Next-Gen SIEMCopy query
| regex("WindowsApps\\\\(?<PackageName>[^\\\\]+)\\\\", field=FilePath, strict=true)
| regex("^(?<PackageBase>[^_]+)", field=PackageName, strict=false)
| ComputerName=~wildcard(?ComputerName, ignoreCase=true)
| PackageBase=~wildcard(?PackageBase, ignoreCase=true)
// Filter out good filepaths
//| !in(field=FilePath, values=[])
// Filter out good Packages
//| !in(field=PackageBase, values=[])
| groupBy([ComputerName, PackageBase])
| sort(ComputerName, order=asc, limit=max)Takes the filepath and pulls out those files loaded into the \Program Files\WindowsApps directory. Then performs a regex to grab just the package name as it should appear if you did a 'Get-AppxPackage on the machine. Outputs a report using computername and PackageBase
windows_store_installs.yml
Craig Roberts
Monitoring
Endpoint
2026-03-04
2026-03-05
