PowerShell PsScript Attempts to Install Unsigned AppX via Add-AppxPackage/Add-AppPackage

Flags PowerShell usage of Add-AppxPackage/Add-AppPackage with -AllowUnsigned to install unsigned AppX packages.

FreeUnreviewedSigmamediumv1

powershell-psscript-attempts-to-install-unsigned-appx-via-add-appxpackage-add-ap-975b2262

title: PowerShell PsScript Attempts to Install Unsigned AppX via Add-AppxPackage/Add-AppPackage
id: fbfb22c4-c4df-42cb-bc67-532feaa06da7
related:
  - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a
    type: similar
  - id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af
    type: similar
  - id: 975b2262-9a49-439d-92a6-0709cccdf0b2
    type: derived
status: test
description: This rule identifies PowerShell script blocks that use Add-AppxPackage (or its alias Add-AppPackage) together with the -AllowUnsigned flag, indicating an attempt to install an unsigned AppX package. Attackers can use this to bypass signature enforcement and run untrusted or tampered app content for persistence or stealth. Telemetry relies on Script Block Logging capturing the ScriptBlockText contents.
references:
  - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
  - https://twitter.com/WindowsDocs/status/1620078135080325122
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_install_unsigned_appx_packages.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-31
tags:
  - attack.persistence
  - attack.stealth
logsource:
  product: windows
  category: ps_script
  definition: Script Block Logging must be enable
detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      - "Add-AppPackage "
      - "Add-AppxPackage "
  selection_flag:
    ScriptBlockText|contains: " -AllowUnsigned"
  condition: all of selection_*
falsepositives:
  - Installation of unsigned packages for testing purposes
level: medium
license: DRL-1.1

What it detects

This rule identifies PowerShell script blocks that use Add-AppxPackage (or its alias Add-AppPackage) together with the -AllowUnsigned flag, indicating an attempt to install an unsigned AppX package. Attackers can use this to bypass signature enforcement and run untrusted or tampered app content for persistence or stealth. Telemetry relies on Script Block Logging capturing the ScriptBlockText contents.

Known false positives

Installation of unsigned packages for testing purposes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.