Windows winget AppInstaller admin_settings registry modification via winget.exe

Detects winget.exe-driven changes to AppInstaller admin_settings in the registry under LocalState\admin_settings.

FreeUnreviewedSigmalowv1

windows-winget-appinstaller-admin-settings-registry-modification-via-winget-exe-6db5eaf9

title: Windows winget AppInstaller admin_settings registry modification via winget.exe
id: 0e9ad49a-0f37-4c27-ad89-332048925409
status: test
description: This rule flags registry writes where winget.exe is the initiating process and the target is the AppInstaller admin_settings stored under the LocalState\admin_settings path. Attackers can use these configuration changes to weaken installation controls, such as enabling local manifests or disabling installer hash checks. The detection relies on Windows registry set events that include the process image path and the registry key being modified.
references:
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
  - https://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCommonCore/Public/winget/AdminSettings.h#L13
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.defense-impairment
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    Image|endswith: \winget.exe
    TargetObject|startswith: \REGISTRY\A\
    TargetObject|endswith: \LocalState\admin_settings
  condition: selection
falsepositives:
  - The event doesn't contain information about the type of change. False positives are expected with legitimate changes
level: low
license: DRL-1.1
related:
  - id: 6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236
    type: derived

What it detects

This rule flags registry writes where winget.exe is the initiating process and the target is the AppInstaller admin_settings stored under the LocalState\admin_settings path. Attackers can use these configuration changes to weaken installation controls, such as enabling local manifests or disabling installer hash checks. The detection relies on Windows registry set events that include the process image path and the registry key being modified.

Known false positives

The event doesn't contain information about the type of change. False positives are expected with legitimate changes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.