Windows winget AppInstaller admin_settings registry modification via winget.exe
Detects winget.exe-driven changes to AppInstaller admin_settings in the registry under LocalState\admin_settings.
FreeReviewedSigma · Low · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-17
- Updated
- 2026-07-30
What it detects
This rule flags registry writes where winget.exe is the initiating process and the target is the AppInstaller admin_settings stored under the LocalState\admin_settings path. Attackers can use these configuration changes to weaken installation controls, such as enabling local manifests or disabling installer hash checks. The detection relies on Windows registry set events that include the process image path and the registry key being modified.
Reporting behind it
- github.comhttps://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- github.comhttps://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCommonCore/Public/winget/AdminSettings.h#L13
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-winget-appinstaller-admin-settings-registry-modification-via-winget-exe-6db5eaf9
title: Windows winget AppInstaller admin_settings registry modification via winget.exe
id: 0e9ad49a-0f37-4c27-ad89-332048925409
status: test
description: This rule flags registry writes where winget.exe is the initiating process and the target is the AppInstaller admin_settings stored under the LocalState\admin_settings path. Attackers can use these configuration changes to weaken installation controls, such as enabling local manifests or disabling installer hash checks. The detection relies on Windows registry set events that include the process image path and the registry key being modified.
references:
- https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- https://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCommonCore/Public/winget/AdminSettings.h#L13
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
modified: 2023-08-17
tags:
- attack.persistence
- attack.defense-impairment
logsource:
product: windows
category: registry_set
detection:
selection:
Image|endswith: \winget.exe
TargetObject|startswith: \REGISTRY\A\
TargetObject|endswith: \LocalState\admin_settings
condition: selection
falsepositives:
- The event doesn't contain information about the type of change. False positives are expected with legitimate changes
level: low
license: DRL-1.1
related:
- id: 6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236
type: derived