Detection: Windows PowerShell MSIX Package Installation

Description

The following analytic detects the execution of PowerShell commands to install unsigned AppX packages using Add-AppxPackage or Add-AppPackage cmdlets with the -AllowUnsigned flag. This detection leverages PowerShell Script Block Logging (EventCode=4104) to capture the full command content. This activity is significant as adversaries may use unsigned AppX packages to install malicious applications, bypass security controls, or establish persistence. If confirmed malicious, this could allow attackers to install unauthorized applications that may contain malware, backdoors, or other malicious components.

Search

1`powershell` EventCode=4104 ScriptBlockText IN("*Add-AppPackage *", "*Add-AppxPackage *") AND ScriptBlockText IN ("* -AllowUnsigned*") 
2| fillnull 
3| stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `windows_powershell_msix_package_installation_filter` 
7| `windows_powershell_msix_package_installation_filter`

Data Source

Name	Platform	Sourcetype	Source
Powershell Script Block Logging 4104	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. Ensure PowerShell Script Block Logging is enabled in your environment to capture the full command content.

Known False Positives

Installation of unsigned packages for testing purposes by developers or system administrators. Legitimate software development and testing activities may trigger this detection. Internal application development teams testing MSIX packages before signing. System administrators installing custom unsigned applications for business purposes. Note: The -AllowUnsigned flag is only available on Windows 11 and later versions.

Associated Analytic Story

• MSIX Package Abuse

• Malicious PowerShell

Risk Based Analytics (RBA)

Risk Message:

The user $user_id$ attempted to install an unsigned AppX package on $dest$ using PowerShell.

References

• https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package

• https://learn.microsoft.com/en-us/windows/msix/desktop/powershell-msix-cmdlets

• https://learn.microsoft.com/en-us/powershell/module/appx/add-appxpackage

• https://twitter.com/WindowsDocs/status/1620078135080325122

• https://attack.mitre.org/techniques/T1059/001/

• https://attack.mitre.org/techniques/T1547/001/

• https://learn.microsoft.com/en-us/powershell/module/appx/add-appxpackage?view=windowsserver2025-ps

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1