MSIX single-click installer executing fake privacy browser package
Detects the invocation of the AppInstaller executable to install .msix packages, often used in software installation or malicious delivery scenarios involving application deployment.
Microsoft Sentinel (KQL)

