Windows winget Install from Zone.Identifier/WinGet Temp Contents Marked by Zone Transfer

title: Windows winget Install from Zone.Identifier/WinGet Temp Contents Marked by Zone Transfer
id: ea93fa0a-d820-4a1f-a02f-7679deac4a61
status: test
description: Flags winget package installations where the payload appears to have an alternate data stream (Zone.Identifier) and originates from a ZoneTransfer-marked source. Attackers can leverage winget to install malicious software while hiding in temporary download locations under WinGet. The rule relies on create_stream_hash-style telemetry capturing Contents starting with a ZoneTransfer ZoneId=3 marker, and TargetFilename patterns pointing to \AppData\Local\Temp\WinGet\ with a :Zone.Identifier stream.
references:
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_winget_susp_package_source.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-18
tags:
  - attack.persistence
  - attack.stealth
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection:
    Contents|startswith: "[ZoneTransfer]  ZoneId=3"
    Contents|contains:
      - ://1
      - ://2
      - ://3
      - ://4
      - ://5
      - ://6
      - ://7
      - ://8
      - ://9
    TargetFilename|endswith: :Zone.Identifier
    TargetFilename|contains: \AppData\Local\Temp\WinGet\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a3f5c081-e75b-43a0-9f5b-51f26fe5dba2
    type: derived