legitimate installation of unsigned packages for legitimate purposes such as development or testing

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/appxdeployment_server/win_appxpackaging_server_unsigned_package_installation.yml>sigma
technicques: t1204 t1204.002 t1553 t1553.005

Techniques

Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events

condition: selection
selection:
  EventID: 603
  Flags: '8388608'