UNCanny: InstallService SYSTEM LoadLibraryW via UNC Path (Machine Account Coercion)
Detects svchost.exe (hosting Windows Store Install Service) loading InstallServicePlugin.dll from a UNC path or making outbound SMB connections as NT AUTHORITY\SYSTEM. This indicates successful UNCanny coercion where the SYSTEM-level service performs LoadLibraryW against an attacker-controlled UNC path, enabling NTLM machine account capture or SYSTEM code execution.
Microsoft Sentinel (KQL)
