CmdID

CmdID / PowerShell / Cmdlets / Add

Add-AppxPackage

Adds a signed app package to a user account. Windows Server PowerShell reference

From the Windows Server PowerShell reference 27 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

27 in the Windows Server PowerShell reference
Show its 27 parameters
-AllowUnsignedAllows adding an unsigned package.
-AppInstallerFileRuns an appinstaller file and allows the user to install all the defined packages with a single click.
-DeferRegistrationWhenPackagesAreInUseSpecifies that the app won't register for a user if currently in use.
-DependencyPackagesSpecifies the dependency package full name or dependency package bundle full name to be registered.
-DependencyPathSpecifies an array of file paths of dependency packages that are required for the installation of the app package.
-DisableDevelopmentModeIndicates that this cmdlet registers an existing app package installation that has been disabled, didn't register, or has become corrupted.
-ExternalLocationURI path of an external disk location outside of the MSIX package where the package manifest can reference application content.
-ExternalPackagesSpecifies an array of optional packages that must be installed along with the app package.
-ForceApplicationShutdownIndicates that this cmdlet forces all active processes associated with the package or its dependencies to shut down.
-ForceTargetApplicationShutdownIndicates that this cmdlet forces all active processes associated with the package to shut down.
-ForceUpdateFromAnyVersionThis parameter is used to force a specific version of a package to be staged or registered, regardless of whether a higher version is already staged or registered.
-InstallAllResourcesIndicates that this cmdlet forces the deployment of all resource packages specified from a bundle argument.
-LimitToExistingPackagesThis parameter is used to prevent missing referenced packages to be downloaded.
-MainPackageSpecifies the main package full name or bundle full name to register.
-OptionalPackagesSpecifies the PackageFamilyName of the optional packages that are in a related set that need to be installed along with the app.
-Path, -PSPathSpecifies the path to the app package file.
-RegisterIndicates that this cmdlet registers an application in development mode.
-RegisterByFamilyNameSpecifies the parameter -MainPackage that defines the family name or full name to be registered.
-RelatedPackagesThis is an optional element that's used to specify the other optional packages that are specified in the main app package.
-RequiredContentGroupOnlySpecifies that only the required content group that's specified in the AppxContentGroupMap.xml must be installed.
-RetainFilesOnFailureIn case of a failed deployment, if this switch is set to $true, files that have been created on the target machine during the installation process aren't removed.
-StageStages a package to the system without registering it.
-StubPackageOptionDefines the stub behavior for an app package that's being added or staged.
-UpdateSpecifies that the package being added is a dependency package update.
-VolumeSpecifies the AppxVolume object to stage the package in.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name Add-AppxPackage
mediumUnsigned AppX Installation Attempt Using Add-AppxPackageNasreddine Bencherchali (Nextron Systems)