Suspicious Install New Package Through Winget Local Manifest (via process_creation)

title: Suspicious Install New Package Through Winget Local Manifest (via process_creation)
id: 8c03aefd-8f9e-57d6-83b1-350d4feee2cc
status: stable
description: This rule detects use of winget to install applications via manifest file. Threat actors can misuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be leveraged to download and install exe, msi or msix files later.
references:
    - https://attack.mitre.org/techniques/T1059/
    - https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
    - https://lolbas-project.github.io/lolbas/Binaries/Winget/
    - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
author: Huntrule Team
date: 2026-04-25
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\winget.exe'
        - OriginalFileName: 'winget.exe'
    selection_install_flag:
        CommandLine|contains:
            - 'install'
            - ' add '
    selection_manifest_flag:
        CommandLine|contains:
            - '-m '
            - '--manifest'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium