UNCanny AppX Cleanup via Get-AppxPackage DiscCoerceProbe Before Coercion
Detects PowerShell execution attempting to interact with AppX packages using 'DiscCoerceProbe'. This activity is often associated with privilege escalation or system manipulation techniques.
Microsoft Sentinel (KQL)

