Windows winget Installs Applications Using Local Manifest File

title: Windows winget Installs Applications Using Local Manifest File
id: a924dbe0-fb51-401f-a4a2-eecd85512c86
status: test
description: This rule identifies Windows processes where winget.exe is used to install software with a local manifest, by matching install-related command-line arguments along with manifest flags (-m or --manifest). Attackers can leverage winget to fetch and install attacker-controlled packages, allowing remote payload delivery followed by execution. The detection relies on process creation telemetry capturing the Image/OriginalFileName for winget.exe and the full command line arguments.
references:
  - https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
  - https://lolbas-project.github.io/lolbas/Binaries/Winget/
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml
author: Sreeman, Florian Roth (Nextron Systems), frack113, Huntrule Team
date: 2020-04-21
modified: 2023-04-17
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \winget.exe
    - OriginalFileName: winget.exe
  selection_install_flag:
    CommandLine|contains:
      - install
      - " add "
  selection_manifest_flag:
    CommandLine|contains:
      - "-m "
      - --manifest
  condition: all of selection_*
falsepositives:
  - Some false positives are expected in some environment that may use this functionality to install and test their custom applications
level: medium
license: DRL-1.1
related:
  - id: 313d6012-51a0-4d93-8dfc-de8553239e25
    type: derived