Windows AppX Deployment Server Installs Unsigned MSIX/AppX with AllowUnsigned

title: Windows AppX Deployment Server Installs Unsigned MSIX/AppX with AllowUnsigned
id: 300c4ced-630f-42fb-b53a-15f2db5c134d
related:
  - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a
    type: similar
  - id: 975b2262-9a49-439d-92a6-0709cccdf0b2
    type: similar
  - id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af
    type: derived
status: experimental
description: This rule flags AppXDeployment-Server events where an MSIX/AppX installation is attempted using the AllowUnsigned capability. Attackers may use unsigned packages to bypass integrity checks and execute or deploy untrusted application content. The detection relies on AppXDeployment-Server telemetry, matching EventID 603 with the specific Flags value indicating an unsigned package installation.
references:
  - https://docs.microsoft.com/en-us/powershell/module/appx/add-appxpackage
  - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxpackaging_server_unsigned_package_installation.yml
author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-03
tags:
  - attack.execution
  - attack.defense-impairment
  - attack.t1204.002
  - attack.t1553.005
logsource:
  product: windows
  service: appxdeployment-server
detection:
  selection:
    EventID: 603
    Flags: "8388608"
  condition: selection
falsepositives:
  - Legitimate installation of unsigned packages for legitimate purposes such as development or testing
level: medium
license: DRL-1.1