UNCanny: PowerShell Add-AppxPackage -Register to UNC Path for NTLM Coercion
Detects attempts to leverage PowerShell to register a loose-file AppX package from a UNC path. This technique can be used to trigger NTLM coercion via InstallService.exe or achieve SYSTEM DLL load, often associated with the 'UNCanny' coercion method. The rule looks for PowerShell command lines containing 'Add-AppxPackage', '-Register', and a UNC path (\\) along with 'AppxManifest.xml'. Additional suspicious indicators like '-ExecutionPolicy Bypass', 'DiscCoerceProbe', 'poc.ps1', 'Invoke-InstallServiceCoerce.ps1', or '-AttackerHost' increase the suspicious score.
Microsoft Sentinel (KQL)
