In brief
A breakdown of UWP/MSIX — in the speaker's words, computer forensics rather than incident response. The isolation UWP was conceived for disappeared after Desktop Bridge and runFullTrust, and the Microsoft Store became a delivery channel for malicious packages and a source of tooling that needs no admin rights. The second half is DFIR artifacts and a minimum of policies and detections; a technical talk, there were no questions.
Key points
- The framing is not incident response but "more about computer forensics"; the speaker has 7 years in information security, Purple Teaming cyber exercises.
- Metro Apps in Windows 8 were isolated; build 1607 and Desktop Bridge made it possible to package Win32 as UWP with access to the system APIs — the isolation was gone. MSIX (an evolution of APPX) carries AppxManifest.xml with runFullTrust, the signature with the certificate, and BlockMap with the hashes of all the files.
- Most malicious MSIX packages are signed with a developer certificate taken from a compromised company; a package is built with the MSIX Packaging Tool, Advanced Installer or MakeAppx + the manifest + SignTool; a self-signed certificate is imported into Trusted Root — and that means admin rights.
- In Windows 11 an unsigned package is installed by a PowerShell cmdlet; the Publisher field then always holds one and the same Organization ID — a ready-made indicator.
- Mid-2023 (Microsoft Threat Intelligence): groups delivered MSIX through ms-appinstaller — phishing, SEO poisoning, ad placements, Teams; Microsoft disabled the handler.
- "A certain CVE" — a bypass of signature validation, the publisher did not match the developer of Perimeter 81 (the number was not named, and the speaker found no description of it); the FIN7 technique — a framework inside the MSIX runs a PS1 or a batch file before the application, per config.json.
- Artifacts: StateRepository-Deployment (the source URL or the path, deeper down — the hashes of the package's files) and a second, unnamed database (the Organization ID, the publisher) — both only about installed applications.
- The event log, four cases: PowerShell with a signed and with an unsigned package (the second one produces event 9545), a double click (the path), ms-appinstaller (the link); App Installer does not see these installations, but it does show winget.
- Without admin rights from the Store: Python and Julia (winget → a reverse shell), the tunnels ngrok and localtunnel ("recently added", "in almost all cases" with ransomware), portable browsers, "SHRDP agents", a RAT such as TeamViewer, VS Code with a code.exe tunnel through GitHub.
- Recommendations: prohibit untrusted packages and the installation of MSIX by unprivileged users, detection rules for the "elevated cmdlet", collection of event 9545 and of four more events in a SIEM.
Tools, artifacts, technologies
- UWP, Metro/Modern Apps, APPX — the history of the format; Desktop Bridge (1607) — criticized: the point where the isolation was lost.
- MSIX, AppxManifest.xml with runFullTrust, BlockMap (the file hashes) — the subject of the talk; BlockMap is useful to the forensic expert.
- MSIX Packaging Tool, Advanced Installer, MakeAppx, SignTool, Trusted Root — building and signing; a PowerShell cmdlet (Windows 11) installs unsigned packages, its name was not given, the indicator is the Organization ID.
- ms-appinstaller (disabled), Microsoft Threat Intelligence, the CVE (the number was not named), Perimeter 81, the FIN7 framework with config.json — the 2023 campaigns.
- StateRepository-Deployment, a second SQLite database (not named), event 9545, the App Installer log, the PowerShell log, a SIEM — the artifacts and their collection.
- winget — from the Store without admin rights; through it Python, Julia, ngrok, localtunnel, VS Code / code.exe, portable browsers, "SHRDP agents", TeamViewer / RAT. Purple Teaming — cyber exercises; Teams, Yandex, Google — phishing and SEO poisoning.
Legal and organizational context
Nothing was said: no laws, no articles, no agencies, no methodologies; the speaker's terminology is "computer forensics", "incident response", "cyber exercises". On the organizational side: Microsoft disabled ms-appinstaller, but itself opened the way for unsigned packages in Windows 11; prohibition policies and the collection of events in a SIEM.
Questions from the audience
There were no questions: after "your questions, if there are any" came the joke "As always, you've broken my whole audience", and then the break until 13:10. The speakers are not labeled: by the context this is the moderator, but it is not obvious.
The speaker's position
The isolation of UWP after Desktop Bridge and runFullTrust is a formality; allowing unsigned packages in Windows 11 both weakens the system and hands the forensic expert a ready-made indicator. The tone is a lecture read off the slides, with no polemics and no sales pitch: F6's products are not named. He acknowledges the limitation of his own artifacts (only installed applications) himself, but devalues it in the same breath; he does not inflate the scale.
Quotes
- "That is, in this case the isolation was gone. And that's a very important point."
- "…most malicious MSIX applications are signed precisely with a developer certificate."
- "There's a certain CVE, and honestly, I never found a more detailed description of how it works…"
- "But actually we don't really need the removed ones in this case."