Unsigned AppX Installation Attempt Using Add-AppxPackage
Detects the use of PowerShell cmdlets 'Add-AppxPackage' or 'Add-AppPackage' with the '-AllowUnsigned' flag to install unsigned AppX packages. This activity can be indicative of an adversary attempting to establish persistence or evade defenses by installing malicious applications that are not signed by a trusted authority.
Sigma
