unsignedmsixpwsh

MHaggis · MHaggis · commit 980d8f6061c9 · 2025-08-18T12:48:12.000-06:00
diff --git a/datasets/attack_techniques/T1553.005/msix_unsigned/msix_unsigned.yml b/datasets/attack_techniques/T1553.005/msix_unsigned/msix_unsigned.yml
@@ -0,0 +1,13 @@
+author: Michael Haag
+id: 4f9b2623-abd5-11eb-926b-120zf0943f22
+date: '2023-06-22'
+description: Detection of unsigned MSIX package installation using PowerShell
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1553.005/msix_unsigned/windows-powershell.log
+sourcetypes:
+- XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+references:
+- https://attack.mitre.org/techniques/T1553/005
+- https://redcanary.com/blog/threat-intelligence/msix-installers/
+- https://redcanary.com/threat-detection-report/techniques/installer-packages/
diff --git a/datasets/attack_techniques/T1553.005/msix_unsigned/windows-powershell.log b/datasets/attack_techniques/T1553.005/msix_unsigned/windows-powershell.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c745b76b3e3556b40e77a9a96dc798ef86e59899501598dc038232f350adb043
+size 3864

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:c745b76b3e3556b40e77a9a96dc798ef86e59899501598dc038232f350adb043`
	`3`	`+size 3864`