Suspicious Unsigned AppX Deployment Attempt Via Add-AppxPackage - PsScript (via ps_script)

title: Suspicious Unsigned AppX Deployment Attempt Via Add-AppxPackage - PsScript (via ps_script)
id: 58bdf5df-e787-5d18-9ae2-68eaab3cea20
status: stable
description: This rule detects use of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages
references:
    - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
    - https://twitter.com/WindowsDocs/status/1620078135080325122
author: Huntrule Team
date: 2026-02-21
tags:
    - attack.persistence
    - attack.stealth
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script Block Logging must be enable
detection:
    selection_cmdlet:
        ScriptBlockText|contains:
            - 'Add-AppPackage '
            - 'Add-AppxPackage '
    selection_flag:
        ScriptBlockText|contains: ' -AllowUnsigned'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium