Windows AppX Deployment Unsigned Package Installation — Detection Rule

Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events

Read the full analysis on IntelFusions