Unsigned AppX Installation Attempt Using Add-AppxPackage
Detects the usage of the "Add-AppxPackage" or its alias "Add-AppPackage" with the "-AllowUnsigned" flag to install unsigned AppX packages. This can be used by adversaries for persistence or defense evasion by installing malicious applications that bypass signature checks.
Sigma
