Executive Summary
UNCanny is a newly disclosed coercion and Local Privilege Escalation (LPE) primitive targeting the Windows Store Install Service (InstallService.exe). By registering a 'loose-file' AppX package from an attacker-controlled UNC path, a standard user can trigger a SYSTEM-level service to perform a LoadLibraryW call against that remote path. This results in the machine account authenticating via NTLM to the attacker's infrastructure or, if a malicious DLL is present, full code execution as SYSTEM.
Technical analysis reveals that the vulnerability lies in the PluginHelpers::ActivatePlugin function within InstallService.dll. When a specific install work item is requested, the service attempts to resolve a plugin by looking up the package's InstalledLocation. If this location is a UNC path—facilitated by loose registration—the service connects to the share and attempts to load InstallServicePlugin.dll. This behavior is persistent; the install queue retries on failure and survives reboots, leading to continuous coercion until the package is removed.
While highly effective for lateral movement and privilege escalation, the technique currently requires 'Developer Mode' to be enabled on the target system to allow the registration of loose-file packages from network shares. This makes it a high-value technique primarily against developer, engineering, and workstation environments where such configurations are common.