Windows winget installs from Zone.Identifier-marked sources in Temp\WinGet

title: Windows winget installs from Zone.Identifier-marked sources in Temp\WinGet
id: ea93fa0a-d820-4a1f-a02f-7679deac4a61
status: test
description: This rule flags winget package installations where the download contents reference a ZoneTransfer source (ZoneId=3) and include suspicious URL patterns. It also requires the target to be the Zone.Identifier alternate data stream and the installer payload to be staged under AppData\Local\Temp\WinGet\, which attackers may use to blend activity with normal package workflows. The detection relies on telemetry that records created stream contents and the target filename/paths for the Zone.Identifier ADS.
references:
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_winget_susp_package_source.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-18
tags:
  - attack.persistence
  - attack.stealth
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection:
    Contents|startswith: "[ZoneTransfer]  ZoneId=3"
    Contents|contains:
      - ://1
      - ://2
      - ://3
      - ://4
      - ://5
      - ://6
      - ://7
      - ://8
      - ://9
    TargetFilename|endswith: :Zone.Identifier
    TargetFilename|contains: \AppData\Local\Temp\WinGet\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a3f5c081-e75b-43a0-9f5b-51f26fe5dba2
    type: derived