Windows Registry: Winget EnableLocalManifestFiles Set to DWORD 1
Flags setting the Winget AppInstaller local manifest installation policy (EnableLocalManifestFiles) to enabled.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-17
- Updated
- 2026-07-30
What it detects
This rule catches when the Winget policy value AppInstaller\\EnableLocalManifestFiles is set to DWORD 0x00000001. Enabling local manifest installation can allow users to install new packages from custom manifests, which may be abused to introduce untrusted software. It relies on registry set telemetry observing changes to the target policy path and the specific value data.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-winget-enablelocalmanifestfiles-set-to-dword-1-fa277e82
title: "Windows Registry: Winget EnableLocalManifestFiles Set to DWORD 1"
id: 3d9563d0-cd5c-46c3-aae8-6ff6aa1962e4
status: test
description: This rule catches when the Winget policy value AppInstaller\\EnableLocalManifestFiles is set to DWORD 0x00000001. Enabling local manifest installation can allow users to install new packages from custom manifests, which may be abused to introduce untrusted software. It relies on registry set telemetry observing changes to the target policy path and the specific value data.
references:
- https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_winget_enable_local_manifest.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
modified: 2023-08-17
tags:
- attack.persistence
- attack.stealth
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|endswith: \AppInstaller\EnableLocalManifestFiles
Details: DWORD (0x00000001)
condition: selection
falsepositives:
- Administrators or developers might enable this for testing purposes or to install custom private packages
level: medium
license: DRL-1.1
related:
- id: fa277e82-9b78-42dd-b05c-05555c7b6015
type: derived