UNCanny AppX UNC Path Registration via Add-AppxPackage -Register

Tim Peck@timpeck

•updated Jun 19, 2026•2•0•29

Detects Add-AppxPackage -Register against a manifest on a UNC path. Legitimate loose-file registration during development points at local paths; a UNC InstalledLocation is the core of UNCanny - it hands the SYSTEM Windows Store InstallService a LoadLibraryW on an attacker-controlled UNC via plugin resolution.