Windows PowerShell: Add-AppxPackage with -AllowUnsigned for Unsigned AppX Installation
Flags PowerShell usage of Add-AppxPackage/Add-AppPackage with -AllowUnsigned to install unsigned AppX packages.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-31
- Updated
- 2026-07-31
What it detects
This rule flags PowerShell script block activity that invokes Add-AppxPackage (or its alias Add-AppPackage) with the -AllowUnsigned flag. Attempting to install unsigned AppX packages can help attackers bypass trust controls and persist stealthily by deploying unverified application packages. It relies on Script Block Logging telemetry capturing the executed cmdlet text and the presence of the unsigned override flag.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
powershell-psscript-attempts-to-install-unsigned-appx-via-add-appxpackage-add-ap-975b2262
title: "Windows PowerShell: Add-AppxPackage with -AllowUnsigned for Unsigned AppX Installation"
id: fbfb22c4-c4df-42cb-bc67-532feaa06da7
related:
- id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a
type: similar
- id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af
type: similar
- id: 975b2262-9a49-439d-92a6-0709cccdf0b2
type: derived
status: test
description: This rule flags PowerShell script block activity that invokes Add-AppxPackage (or its alias Add-AppPackage) with the -AllowUnsigned flag. Attempting to install unsigned AppX packages can help attackers bypass trust controls and persist stealthily by deploying unverified application packages. It relies on Script Block Logging telemetry capturing the executed cmdlet text and the presence of the unsigned override flag.
references:
- https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
- https://twitter.com/WindowsDocs/status/1620078135080325122
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_install_unsigned_appx_packages.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-31
tags:
- attack.persistence
- attack.stealth
logsource:
product: windows
category: ps_script
definition: Script Block Logging must be enable
detection:
selection_cmdlet:
ScriptBlockText|contains:
- "Add-AppPackage "
- "Add-AppxPackage "
selection_flag:
ScriptBlockText|contains: " -AllowUnsigned"
condition: all of selection_*
falsepositives:
- Installation of unsigned packages for testing purposes
level: medium
license: DRL-1.1