Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation

Detects PowerShell Add-AppxPackage usage with -AllowUnsigned to install unsigned AppX packages.

FreeUnreviewedSigmamediumv1

windows-powershell-add-appxpackage-attempt-with-allowunsigned-for-appx-installat-37651c2a

title: "Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation"
id: db6bf7a1-07b1-42f9-9b5b-2fe8bdaec1f8
related:
  - id: 975b2262-9a49-439d-92a6-0709cccdf0b2
    type: similar
  - id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af
    type: similar
  - id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a
    type: derived
status: test
description: This rule flags PowerShell executions of Add-AppxPackage (or its Add-AppPackage alias) that include the -AllowUnsigned flag, indicating an attempt to install unsigned AppX/MSIX content. Attackers may use this capability to bypass signature enforcement and persist by deploying untrusted packages. The detection relies on process creation telemetry capturing the PowerShell binary path and the full command line parameters.
references:
  - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
  - https://twitter.com/WindowsDocs/status/1620078135080325122
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_install_unsigned_appx_packages.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-31
tags:
  - attack.persistence
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cmdlet:
    CommandLine|contains:
      - "Add-AppPackage "
      - "Add-AppxPackage "
  selection_flag:
    CommandLine|contains: " -AllowUnsigned"
  condition: all of selection_*
falsepositives:
  - Installation of unsigned packages for testing purposes
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell executions of Add-AppxPackage (or its Add-AppPackage alias) that include the -AllowUnsigned flag, indicating an attempt to install unsigned AppX/MSIX content. Attackers may use this capability to bypass signature enforcement and persist by deploying untrusted packages. The detection relies on process creation telemetry capturing the PowerShell binary path and the full command line parameters.

Known false positives

Installation of unsigned packages for testing purposes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.