Sigma rule: Install New Package Via Winget Local Manifest

Rule

Title

Install New Package Via Winget Local Manifest

Status

test

Level

medium

Author

Sreeman, Florian Roth (Nextron Systems), frack113

Date

2020-04-21

Modified

2023-04-17

File

rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\winget.exe'
    - OriginalFileName: 'winget.exe'
selection_install_flag:
    CommandLine|contains:
        - 'install'
        - ' add ' # https://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCLICore/Commands/InstallCommand.h
selection_manifest_flag:
    CommandLine|contains:
        - '-m '
        - '--manifest'
condition: all of selection_*

False positives (as the rule lists them)

• Some false positives are expected in some environment that may use this functionality to install and test their custom applications

Tags

• attack.execution
• attack.t1059

MITRE ATT&CK ids this rule names

• T1059

References

• https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
• https://lolbas-project.github.io/lolbas/Binaries/Winget/
• https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml