Microsoft Winget: Execution of local manifest installation
Adversaries may abuse the Windows Package Manager (winget) to install arbitrary applications by passing local manifest files, potentially leading to the execution of malicious payloads.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 03:08 UTC
- Detection
- 1 rule
- Source quality
- B2Likely
The Windows Package Manager (winget) includes functionality to install applications using a local manifest file (YAML). This capability, while designed for administrative use and local testing, allows for the installation of software from local sources. Adversaries can leverage this feature to execute or install malicious files (such as .exe, .msi, or .msix) by providing a crafted manifest, effectively using winget as a LOLBin (Living-off-the-Land Binary) to facilitate the execution of arbitrary payloads.
Impact
The use of this technique can result in unauthorized application installation and potential code execution on a target endpoint, depending on the contents of the local manifest and the associated payload.
Recommendation
Deploy the provided Sigma rule to monitor process-creation events for suspicious command-line arguments involving winget. Environments that do not use local manifest installation for software deployment should treat any detection as a high-fidelity alert.
Immediate actions
Deploy the Sigma rule to SIEM
Threat Hunt
Identify all winget.exe process executions containing manifest flags in historical logs
Data: Process command line arguments
Detection coverage 1
Detect Execution of Winget with Local Manifest
mediumDetects the use of winget to install packages via a local manifest file, a technique which can be abused to download and execute malicious payloads.
Detection queries are available on the platform. Get full rules →