UNCanny: Add-AppxPackage -Register with UNC InstalledLocation (UNCanny Coerce)
Detects PowerShell executing 'Add-AppxPackage -Register' with a UNC path, which is a core primitive of the UNCanny InstallService coercion attack. This indicates an attempt to register a loose-file AppX package from a network share.
Microsoft Sentinel (KQL)
