{"id":"313d6012-51a0-4d93-8dfc-de8553239e25","title":"Install New Package Via Winget Local Manifest","description":"Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.\nThe manifest option enables you to install an application by passing in a YAML file directly to the client.\nWinget can be used to download and install exe, msi or msix files later.\n","author":"Sreeman, Florian Roth (Nextron Systems), frack113","status":"test","level":"medium","date":"2020-04-21","modified":"2023-04-17","tags":["attack.execution","attack.t1059"],"technique_ids":["T1059"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Some false positives are expected in some environment that may use this functionality to install and test their custom applications"],"references":["https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install","https://lolbas-project.github.io/lolbas/Binaries/Winget/","https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget"],"source_path":"rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml","source_sha256":"371097fb46190a42a104fdd03cc44b94f737de389ea98b0cc6ad824fdd7a5739","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Install New Package Via Winget Local Manifest\nid: 313d6012-51a0-4d93-8dfc-de8553239e25\nstatus: test\ndescription: |\n    Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.\n    The manifest option enables you to install an application by passing in a YAML file directly to the client.\n    Winget can be used to download and install exe, msi or msix files later.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install\n    - https://lolbas-project.github.io/lolbas/Binaries/Winget/\n    - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget\nauthor: Sreeman, Florian Roth (Nextron Systems), frack113\ndate: 2020-04-21\nmodified: 2023-04-17\ntags:\n    - attack.execution\n    - attack.t1059\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\winget.exe'\n        - OriginalFileName: 'winget.exe'\n    selection_install_flag:\n        CommandLine|contains:\n            - 'install'\n            - ' add ' # https://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCLICore/Commands/InstallCommand.h\n    selection_manifest_flag:\n        CommandLine|contains:\n            - '-m '\n            - '--manifest'\n    condition: all of selection_*\nfalsepositives:\n    - Some false positives are expected in some environment that may use this functionality to install and test their custom applications\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"}],"data_path":"data/detection-rules/313d6012-51a0-4d93-8dfc-de8553239e25.json","kind":"sigma"}