My new research paper gives the MSIX Package Support Framework a defensive security review: a threat model, benign local validation.
The Package Support Framework (PSF) is how most teams get legacy Win32 applications running inside MSIX. It is genuinely useful. It is also a full-trust layer that can run code before the user ever sees the application, and most packaging pipelines treat it as a routine default rather than a security decision.
So I asked a simple question: how much additional risk does PSF actually introduce in full-trust and App Attach environments, and which controls contain it without losing the compatibility value?
I have written up the answer as a new research paper.
📄 Read the full paper (open access, CC BY 4.0): A Defensive Security Analysis of the MSIX Package Support Framework
What you will find in it
The paper is a defensive analysis, not an exploit guide. It includes a threat model that pinpoints exactly where attacker-controlled content can enter a PSF-enabled package, a benign marker-only validation harness that tests those trust boundaries, App Control for Business (WDAC) and package-integrity results, App Attach lifecycle findings, and a 16-point enterprise mitigation framework and release-gate checklist. Every claim is graded by evidence level so nothing is overstated.
The short version of the conclusion is that PSF is not inherently unsafe, but it should be treated as a trusted, full-trust compatibility layer rather than a packaging default. The most important risk is not a user editing an installed package; it is content that enters the package before it is signed. The paper shows why, with the evidence behind it.
If you package applications, run Azure Virtual Desktop App Attach at scale, or own application control policy, it was written for you.
📄 Read it here: https://doi.org/10.5281/zenodo.20497114
If you reproduce any of it, or think I have a boundary wrong, I want to hear about it. That is the point of publishing openly.
References
- A Defensive Security Analysis of the MSIX Package Support Framework (Zenodo, DOI)
- Package Support Framework Overview - Microsoft Learn
- Run scripts with the Package Support Framework - Microsoft Learn
- Enforce Package Integrity Check - Microsoft Learn
- Sign an MSIX package - Microsoft Learn
- App Attach in Azure Virtual Desktop - Microsoft Learn
Frequently asked questions
Is the MSIX Package Support Framework safe to use?
PSF is not inherently unsafe, but it should be treated as a trusted, full-trust compatibility layer rather than a packaging default. It can run code before the user ever sees the application, so enabling it is a security decision that belongs in your release gate, not a routine step in the packaging pipeline.
What is the biggest security risk with PSF?
Content that enters the package before it is signed. The common assumption is that the risk is a user editing an installed package, but the decisive trust boundary sits earlier, in the packaging pipeline itself. That is where attacker-controlled content can reach a full-trust layer and inherit the signature.
What does the PSF security paper contain?
A threat model identifying where attacker-controlled content can enter a PSF-enabled package, a benign marker-only validation harness that tests those boundaries, App Control for Business and package-integrity results, App Attach lifecycle findings, and a 16-point enterprise mitigation framework with a release-gate checklist. Claims are graded by evidence level.
Who is the PSF analysis written for?
Anyone who packages applications, runs Azure Virtual Desktop App Attach at scale, or owns application control policy. It is published open access under CC BY 4.0, and reproduction or challenge is explicitly welcome: that is the point of publishing the threat model and the harness openly.
