MSIX'd Up - Weaponizing the Modern Windows App Packaging Ecosystem

Nick Powers argues that the Windows app packaging stack, which includes MSIX, AppContainers, package identity and capabilities, is widely deployed yet rarely studied from an offensive angle. He walks through an attack path in stages, starting with initial access. The MS App Installer protocol handler has been disabled, but app installer files can still stage a signed MSIX install that streams the package into memory. Scraping about 40,000 Store apps showed that nearly half declared the restricted run-full-trust capability, so publishing a capable app proved easier than he expected.

Once on a host, he shows that AppContainer processes can be launched with capabilities such as internet client, broad file system access and enterprise authentication. Some standard file APIs were denied, but a Win32 wrapper path honored the capability. He demonstrates this with a Mythic agent and notes that the EDR products he reviewed did not inject user-mode hooks into these processes, though kernel telemetry still sees them. For lateral movement, he installs a certificate and pushes a package through WMI MDM classes, then activates it over DCOM from a WMI event subscription so it applies to all users.

For privilege escalation, a logic flaw in the modifiable apps capability, combined with symbolic links, yields an arbitrary read. Pairing that with an MSI installed at a UI level that does not require admin lets the attacker create a volume shadow copy and read the SAM, SYSTEM and SECURITY hives. The main prerequisite is that system protection is enabled. He closes with defensive ideas, such as hunting for AppContainer processes with no matching installed package and for packages installed from remote URIs.