# UWP in the DFIR crosshairs: what modern Windows apps are hiding Vladislav Azersky · F6 MOSCOW FORENSICS DAY ’25 · Day 2 — Friday, 12 September 2025: information security day · Scheduled 12:15–12:35 · In the recording 05:28:04–05:48:21 Talk summary · https://2025.moscow-forensics-day.workers.dev/en/summary/13-azersky Transcript: https://2025.moscow-forensics-day.workers.dev/en/transcript/13-azersky · Slides: https://2025.moscow-forensics-day.workers.dev/en/slides/12-azerskii-uwp-dfir · Watch from 05:28:04: https://youtu.be/4V7Wez3L_58?t=19684 --- ## In brief A breakdown of UWP/MSIX — in the speaker's words, computer forensics rather than incident response. The isolation UWP was conceived for disappeared after Desktop Bridge and runFullTrust, and the Microsoft Store became a delivery channel for malicious packages and a source of tooling that needs no admin rights. The second half is DFIR artifacts and a minimum of policies and detections; a technical talk, there were no questions. ## Key points - The framing is not incident response but "more about computer forensics"; the speaker has 7 years in information security, Purple Teaming cyber exercises. - Metro Apps in Windows 8 were isolated; build 1607 and Desktop Bridge made it possible to package Win32 as UWP with access to the system APIs — the isolation was gone. MSIX (an evolution of APPX) carries AppxManifest.xml with runFullTrust, the signature with the certificate, and BlockMap with the hashes of all the files. - Most malicious MSIX packages are signed with a developer certificate taken from a compromised company; a package is built with the MSIX Packaging Tool, Advanced Installer or MakeAppx + the manifest + SignTool; a self-signed certificate is imported into Trusted Root — and that means admin rights. - In Windows 11 an unsigned package is installed by a PowerShell cmdlet; the Publisher field then always holds one and the same Organization ID — a ready-made indicator. - Mid-2023 (Microsoft Threat Intelligence): groups delivered MSIX through ms-appinstaller — phishing, SEO poisoning, ad placements, Teams; Microsoft disabled the handler. - "A certain CVE" — a bypass of signature validation, the publisher did not match the developer of Perimeter 81 (the number was not named, and the speaker found no description of it); the FIN7 technique — a framework inside the MSIX runs a PS1 or a batch file before the application, per config.json. - Artifacts: StateRepository-Deployment (the source URL or the path, deeper down — the hashes of the package's files) and a second, unnamed database (the Organization ID, the publisher) — both only about installed applications. - The event log, four cases: PowerShell with a signed and with an unsigned package (the second one produces event 9545), a double click (the path), ms-appinstaller (the link); App Installer does not see these installations, but it does show winget. - Without admin rights from the Store: Python and Julia (winget → a reverse shell), the tunnels ngrok and localtunnel ("recently added", "in almost all cases" with ransomware), portable browsers, "SHRDP agents", a RAT such as TeamViewer, VS Code with a code.exe tunnel through GitHub. - Recommendations: prohibit untrusted packages and the installation of MSIX by unprivileged users, detection rules for the "elevated cmdlet", collection of event 9545 and of four more events in a SIEM. ## Tools, artifacts, technologies - **UWP, Metro/Modern Apps, APPX** — the history of the format; **Desktop Bridge (1607)** — criticized: the point where the isolation was lost. - **MSIX**, AppxManifest.xml with runFullTrust, BlockMap (the file hashes) — the subject of the talk; BlockMap is useful to the forensic expert. - **MSIX Packaging Tool, Advanced Installer, MakeAppx, SignTool, Trusted Root** — building and signing; a PowerShell cmdlet (Windows 11) installs unsigned packages, its name was not given, the indicator is the Organization ID. - **ms-appinstaller** (disabled), Microsoft Threat Intelligence, the CVE (the number was not named), Perimeter 81, the FIN7 framework with config.json — the 2023 campaigns. - **StateRepository-Deployment**, a second SQLite database (not named), event 9545, the App Installer log, the PowerShell log, a SIEM — the artifacts and their collection. - **winget** — from the Store without admin rights; through it Python, Julia, ngrok, localtunnel, VS Code / code.exe, portable browsers, "SHRDP agents", TeamViewer / RAT. **Purple Teaming** — cyber exercises; Teams, Yandex, Google — phishing and SEO poisoning. ## Legal and organizational context Nothing was said: no laws, no articles, no agencies, no methodologies; the speaker's terminology is "computer forensics", "incident response", "cyber exercises". On the organizational side: Microsoft disabled ms-appinstaller, but itself opened the way for unsigned packages in Windows 11; prohibition policies and the collection of events in a SIEM. ## Questions from the audience There were no questions: after "your questions, if there are any" came the joke "As always, you've broken my whole audience", and then the break until 13:10. The speakers are not labeled: by the context this is the moderator, but it is not obvious. ## The speaker's position The isolation of UWP after Desktop Bridge and runFullTrust is a formality; allowing unsigned packages in Windows 11 both weakens the system and hands the forensic expert a ready-made indicator. The tone is a lecture read off the slides, with no polemics and no sales pitch: F6's products are not named. He acknowledges the limitation of his own artifacts (only installed applications) himself, but devalues it in the same breath; he does not inflate the scale. ## Quotes - "That is, in this case the isolation was gone. And that's a very important point." - "…most malicious MSIX applications are signed precisely with a developer certificate." - "There's a certain CVE, and honestly, I never found a more detailed description of how it works…" - "But actually we don't really need the removed ones in this case."