Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation
Detects PowerShell Add-AppxPackage usage with -AllowUnsigned to install unsigned AppX packages.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-31
- Updated
- 2026-07-30
What it detects
This rule flags PowerShell executions of Add-AppxPackage (or its Add-AppPackage alias) that include the -AllowUnsigned flag, indicating an attempt to install unsigned AppX/MSIX content. Attackers may use this capability to bypass signature enforcement and persist by deploying untrusted packages. The detection relies on process creation telemetry capturing the PowerShell binary path and the full command line parameters.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
- twitter.comhttps://twitter.com/WindowsDocs/status/1620078135080325122
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_install_unsigned_appx_packages.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-add-appxpackage-attempt-with-allowunsigned-for-appx-installat-37651c2a
title: "Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation"
id: db6bf7a1-07b1-42f9-9b5b-2fe8bdaec1f8
related:
- id: 975b2262-9a49-439d-92a6-0709cccdf0b2
type: similar
- id: 9a025188-6f2d-42f8-bb2f-d3a83d24a5af
type: similar
- id: 37651c2a-42cd-4a69-ae0d-22a4349aa04a
type: derived
status: test
description: This rule flags PowerShell executions of Add-AppxPackage (or its Add-AppPackage alias) that include the -AllowUnsigned flag, indicating an attempt to install unsigned AppX/MSIX content. Attackers may use this capability to bypass signature enforcement and persist by deploying untrusted packages. The detection relies on process creation telemetry capturing the PowerShell binary path and the full command line parameters.
references:
- https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
- https://twitter.com/WindowsDocs/status/1620078135080325122
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_install_unsigned_appx_packages.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-31
tags:
- attack.persistence
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
selection_cmdlet:
CommandLine|contains:
- "Add-AppPackage "
- "Add-AppxPackage "
selection_flag:
CommandLine|contains: " -AllowUnsigned"
condition: all of selection_*
falsepositives:
- Installation of unsigned packages for testing purposes
level: medium
license: DRL-1.1