Windows winget Installs Applications Using Local Manifest File
Flags winget.exe install commands that specify a local manifest file via -m/--manifest.
- Product
- windows
- Category
- process_creation
- Author
- Sreeman, Florian Roth (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2020-04-21
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows processes where winget.exe is used to install software with a local manifest, by matching install-related command-line arguments along with manifest flags (-m or --manifest). Attackers can leverage winget to fetch and install attacker-controlled packages, allowing remote payload delivery followed by execution. The detection relies on process creation telemetry capturing the Image/OriginalFileName for winget.exe and the full command line arguments.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Winget/
- github.comhttps://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows winget Installs Applications Using Local Manifest File
id: a924dbe0-fb51-401f-a4a2-eecd85512c86
status: test
description: This rule identifies Windows processes where winget.exe is used to install software with a local manifest, by matching install-related command-line arguments along with manifest flags (-m or --manifest). Attackers can leverage winget to fetch and install attacker-controlled packages, allowing remote payload delivery followed by execution. The detection relies on process creation telemetry capturing the Image/OriginalFileName for winget.exe and the full command line arguments.
references:
- https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
- https://lolbas-project.github.io/lolbas/Binaries/Winget/
- https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml
author: Sreeman, Florian Roth (Nextron Systems), frack113, Huntrule Team
date: 2020-04-21
modified: 2023-04-17
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \winget.exe
- OriginalFileName: winget.exe
selection_install_flag:
CommandLine|contains:
- install
- " add "
selection_manifest_flag:
CommandLine|contains:
- "-m "
- --manifest
condition: all of selection_*
falsepositives:
- Some false positives are expected in some environment that may use this functionality to install and test their custom applications
level: medium
license: DRL-1.1
related:
- id: 313d6012-51a0-4d93-8dfc-de8553239e25
type: derived