KQL Search

# *Detect Unsigned or DevSigned Appx Package Installation*

## Query Information

#### MITRE ATT&CK Technique(s)

| Technique ID | Title    | Link    |
| ---  | --- | --- |
| T1059.001 | Powershell | https://attack.mitre.org/techniques/T1562/001/ |
| T1204.002 | User Execution: Malicious File | https://attack.mitre.org/techniques/T1204/002/ |

#### Description
This KQL query is designed to detect the Installation of unsigned oder Developer Signed Appx/MSIX Packages

#### Risk
Detection of no-defender-loader

#### Author <Optional>
- **Name: Benjamin Zulliger**
- **Github: https://github.com/benscha/KQLAdvancedHunting**
- **LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/**

#### References
- https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html


## Defender XDR
```KQL
let SuspiciousAppxInstalls = 
    DeviceProcessEvents 
    | where FileName in~ ("powershell.exe", "pwsh.exe") 
    | where ProcessCommandLine has_any ("Add-AppxPackage", "Add-AppPackage", ".appx", ".msix") 
    | where ProcessCommandLine !contains "8wekyb3d8bbwe" 
    | where ProcessCommandLine !contains "cw5n1h2txyewy"
    | project ProcessTimestamp = Timestamp, DeviceId, DeviceName, ProcessAccountName = AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let DevSignedAppxPackageInstallation = DeviceEvents
| where AdditionalFields has "EventID=855"
| join kind=inner (
    SuspiciousAppxInstalls
) on DeviceId
| where abs(datetime_diff('second', Timestamp, ProcessTimestamp)) <= 300 
| project Timestamp, ProcessTimestamp, DeviceName, ActionType, ProcessAccountName, ProcessCommandLine, FileName, FolderPath, AdditionalFields
| sort by Timestamp desc;
let AppXUnsignedInstallation = DeviceEvents
| where AdditionalFields has "EventID=603"
| extend Flags = parse_json(AdditionalFields).Flags
| where Flags == "8388608";
DevSignedAppxPackageInstallation
| union (AppXUnsignedInstallation)
```