Install New Package Via Winget Local Manifest — Sigma Rule

Rule metadata and linked tags

Author: Sreeman, Florian Roth (Nextron Systems), frack113. Source status: test; severity: medium. Source dates: 2020-04-21 / 2023-04-17.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 371097fb46190a42a104fdd03cc44b94f737de389ea98b0cc6ad824fdd7a5739

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Install New Package Via Winget Local Manifest
id: 313d6012-51a0-4d93-8dfc-de8553239e25
status: test
description: |
    Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
    The manifest option enables you to install an application by passing in a YAML file directly to the client.
    Winget can be used to download and install exe, msi or msix files later.
references:
    - https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
    - https://lolbas-project.github.io/lolbas/Binaries/Winget/
    - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
author: Sreeman, Florian Roth (Nextron Systems), frack113
date: 2020-04-21
modified: 2023-04-17
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\winget.exe'
        - OriginalFileName: 'winget.exe'
    selection_install_flag:
        CommandLine|contains:
            - 'install'
            - ' add ' # https://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCLICore/Commands/InstallCommand.h
    selection_manifest_flag:
        CommandLine|contains:
            - '-m '
            - '--manifest'
    condition: all of selection_*
falsepositives:
    - Some false positives are expected in some environment that may use this functionality to install and test their custom applications
level: medium

Original YAML and metadata in JSON

False positives

• Some false positives are expected in some environment that may use this functionality to install and test their custom applications

Source references

• https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
• https://lolbas-project.github.io/lolbas/Binaries/Winget/
• https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget