Windows Registry: Winget EnableLocalManifestFiles Set to DWORD 1

Flags setting the Winget AppInstaller local manifest installation policy (EnableLocalManifestFiles) to enabled.

FreeUnreviewedSigmamediumv1

windows-registry-winget-enablelocalmanifestfiles-set-to-dword-1-fa277e82

title: "Windows Registry: Winget EnableLocalManifestFiles Set to DWORD 1"
id: 3d9563d0-cd5c-46c3-aae8-6ff6aa1962e4
status: test
description: This rule catches when the Winget policy value AppInstaller\\EnableLocalManifestFiles is set to DWORD 0x00000001. Enabling local manifest installation can allow users to install new packages from custom manifests, which may be abused to introduce untrusted software. It relies on registry set telemetry observing changes to the target policy path and the specific value data.
references:
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_winget_enable_local_manifest.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.stealth
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: \AppInstaller\EnableLocalManifestFiles
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Administrators or developers might enable this for testing purposes or to install custom private packages
level: medium
license: DRL-1.1
related:
  - id: fa277e82-9b78-42dd-b05c-05555c7b6015
    type: derived

What it detects

This rule catches when the Winget policy value AppInstaller\\EnableLocalManifestFiles is set to DWORD 0x00000001. Enabling local manifest installation can allow users to install new packages from custom manifests, which may be abused to introduce untrusted software. It relies on registry set telemetry observing changes to the target policy path and the specific value data.

Known false positives

Administrators or developers might enable this for testing purposes or to install custom private packages

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.