Windows winget Install from Zone.Identifier/WinGet Temp Contents Marked by Zone Transfer
Alerts on winget staging under Temp\WinGet combined with ZoneTransfer ZoneId=3 and Zone.Identifier ADS contents.
- Product
- windows
- Category
- create_stream_hash
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-18
- Updated
- 2026-07-31
What it detects
Flags winget package installations where the payload appears to have an alternate data stream (Zone.Identifier) and originates from a ZoneTransfer-marked source. Attackers can leverage winget to install malicious software while hiding in temporary download locations under WinGet. The rule relies on create_stream_hash-style telemetry capturing Contents starting with a ZoneTransfer ZoneId=3 marker, and TargetFilename patterns pointing to \AppData\Local\Temp\WinGet\ with a :Zone.Identifier stream.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows winget Install from Zone.Identifier/WinGet Temp Contents Marked by Zone Transfer
id: ea93fa0a-d820-4a1f-a02f-7679deac4a61
status: test
description: Flags winget package installations where the payload appears to have an alternate data stream (Zone.Identifier) and originates from a ZoneTransfer-marked source. Attackers can leverage winget to install malicious software while hiding in temporary download locations under WinGet. The rule relies on create_stream_hash-style telemetry capturing Contents starting with a ZoneTransfer ZoneId=3 marker, and TargetFilename patterns pointing to \AppData\Local\Temp\WinGet\ with a :Zone.Identifier stream.
references:
- https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_winget_susp_package_source.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-18
tags:
- attack.persistence
- attack.stealth
logsource:
product: windows
category: create_stream_hash
detection:
selection:
Contents|startswith: "[ZoneTransfer] ZoneId=3"
Contents|contains:
- ://1
- ://2
- ://3
- ://4
- ://5
- ://6
- ://7
- ://8
- ://9
TargetFilename|endswith: :Zone.Identifier
TargetFilename|contains: \AppData\Local\Temp\WinGet\
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a3f5c081-e75b-43a0-9f5b-51f26fe5dba2
type: derived