UNCanny InstallServiceControl PowerShell Coercion via CreateInstallServiceWork

Brandon Rodriguez@BMRodriguez

•updated Jun 22, 2026•0•0•1

Detects PowerShell invoking Windows.Internal.InstallService.Control to create an install work item via the UNCanny coercion primitive. This COM-based API call triggers the Windows Store Install Service to process a work item from an attacker-controlled UNC path, resulting in NTLM machine account coercion or SYSTEM-level DLL execution.