pwshmsix

MHaggis · MHaggis · commit a589fcfc0f67 · 2025-08-18T11:22:04.000-06:00
diff --git a/datasets/attack_techniques/T1059.001/msix_powershell/msix_powershell.yml b/datasets/attack_techniques/T1059.001/msix_powershell/msix_powershell.yml
@@ -0,0 +1,13 @@
+author: Michael Haag
+id: 3f9b2623-abd5-11eb-926b-120zf0943f11
+date: '2023-06-22'
+description: PowerShell execution from MSIX packages and WindowsApps directory
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon.log
+sourcetypes:
+- XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+references:
+- https://attack.mitre.org/techniques/T1059/001
+- https://redcanary.com/blog/threat-intelligence/msix-installers/
+- https://redcanary.com/threat-detection-report/techniques/installer-packages/
diff --git a/datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon.log b/datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3f349b90eead3e2eda89bcc776b5f250f1ece2bd1a2c9d128ca79ad087d72e93
+size 7346

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:3f349b90eead3e2eda89bcc776b5f250f1ece2bd1a2c9d128ca79ad087d72e93`
	`3`	`+size 7346`