attack.t1546.016 | Detection.FYI

Non-Microsoft App Package Installation Process

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·
Share on:

Detects app package installation processes where the app is not a Microsoft app based on the publisher ID. Part of the RedCanary 2024 Threat Detection Report.

Read More
Package Support Framework (PSF) Advanced Installer Processes

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1546 attack.t1546.016 ·
Share on:

Detects app package installation processes where legitimate software is included in an MSIX package, but a malicious PowerShell script may execute beforehand by employing the Package Support Framework (PSF). In these cases, the MSIX package includes the malicious script, which is executed as specified in an included config.json file. Part of the RedCanary 2024 Threat Detection Report.

Read More