UnCanny Coercion - AppxPackage Registration via UNC Path

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•8

Detects attempts to register an AppxPackage from a UNC path using PowerShell, which is a prerequisite for the UnCanny LPE/Coercion attack. This technique leverages the Add-AppxPackage cmdlet with the -Register parameter and a UNC path.