Windows AppX Deployment Full Trust Package Installation — Detection Rule

Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions

Read the full analysis on IntelFusions