[NEW CONTENT TYPE REQUEST] .PPKG

**What type of file would you like magika to detect?**

- Windows Imaging / Windows Provisioning Package (.ppkg)

**What software can create/open these files?**

- Windows Configuration Designer, available via Microsoft Store or as part of Windows ADK (used to create .ppkg files)
- ProvTool, a CLI utility included in the Windows ADK (used to apply/open .ppkg files)
- Windows itself can apply .ppkg files during setup (OOBE) or from system settings
- Also used in Microsoft Endpoint Manager / Intune

**Where can these files be found?**

- Generated using Windows Configuration Designer
- Used during Windows deployment and setup in enterprise environments
- Applied through OOBE, system settings, or command line via ProvTool
- Commonly found in corporate IT infrastructure or provisioning pipelines

**If possible, please provide a specification for this file type.**

Microsoft Docs:

[Provisioning packages overview](https://learn.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-packages)
[Create provisioning packages](https://learn.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-create-package)

Example of ppkg file:

[AG2.zip](https://github.com/user-attachments/files/19903360/AG2.zip)

**Additional context**

Provisioning packages (.ppkg) are widely used for setting up and configuring Windows devices in enterprise environments. They can be applied during setup or after deployment using built-in tools or ProvTool. Currently, Magika doesn’t detect .ppkg files therefore adding support would improve file recognition in enterprise IT workflows.

Recently, we’ve observed that .ppkg files are being abused by threat actors to deliver malware . Considering that Magika is integrated into content scanning workflows for Gmail and other Google services, supporting detection of this file type could help flag or route suspicious .ppkg attachments more effectively, reducing the risk of security breaches through misclassified file types.
Ref:

1. https://www.virustotal.com/gui/file/5f8f8a868b25435b37e632b4e4e3b23f24092cbf075d7c0d9b7b960615738c7c/detection
2. https://app.any.run/tasks/612ad078-b7de-4770-8ef7-a95791a29614


Start by reading the linked Microsoft provisioning-package documentation and inspecting the provided AG2.zip example. Determine how Magika represents and validates new file types; done means valid .ppkg files are recognized reliably, including the supplied example, without misclassifying unrelated files.

Written by the indexing model from the issue text.