Skip to content
Threat Feed
Subscribe
low advisory

Winget Admin Settings Modification

Modification of Windows AppInstaller (winget) administrative settings via registry changes can be used to weaken security controls, such as enabling local manifest installations or disabling installer hash checks.

Triage facts

Revision 1
Evidence
Unknown
Severity
Low
Sources
3 public sources
Freshness
Revision 1Nov 10, 03:09 UTC
Detection
1 rule
Source quality
A2Roughly even chance

Adversaries may modify registry keys associated with the Windows AppInstaller (winget) to lower security thresholds. These modifications can enable the installation of packages from local manifests or disable mandatory installer hash checks. This behavior is associated with defense impairment and persistence.

Detection coverage 1

Winget Admin Settings Modification

low

Detects changes to the AppInstaller (winget) admin settings, such as enabling local manifest installations or disabling installer hash checks.

sigma tactics: defense-impairment, persistence sources: registry_set, windows

Detection queries are available on the platform. Get full rules →