UNCanny: Add-AppxPackage -Register from UNC Path (InstallService Coercion)

Brandon Rodriguez@BMRodriguez

•updated Jun 22, 2026•0•0•8

Detects PowerShell invoking Add-AppxPackage -Register with a UNC path, the initial trigger in the UNCanny attack chain. A standard user registers a loose-file AppX package from an attacker-controlled SMB share, causing the Windows Store Install Service (running as SYSTEM) to perform a LoadLibraryW call against the remote path.