{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/system-administration/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["lolbin","execution","windows","system-administration"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Windows Package Manager (winget) includes functionality to install applications using a local manifest file (YAML). This capability, while designed for administrative use and local testing, allows for the installation of software from local sources. Adversaries can leverage this feature to execute or install malicious files (such as .exe, .msi, or .msix) by providing a crafted manifest, effectively using winget as a LOLBin (Living-off-the-Land Binary) to facilitate the execution of arbitrary payloads.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe use of this technique can result in unauthorized application installation and potential code execution on a target endpoint, depending on the contents of the local manifest and the associated payload.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy the provided Sigma rule to monitor process-creation events for suspicious command-line arguments involving winget. Environments that do not use local manifest installation for software deployment should treat any detection as a high-fidelity alert.\u003c/p\u003e\n","date_modified":"2026-11-10T03:08:13Z","date_published":"2026-11-10T03:08:13Z","id":"https://feed.craftedsignal.io/briefs/2026-11-winget-local-manifest/","summary":"Adversaries may abuse the Windows Package Manager (winget) to install arbitrary applications by passing local manifest files, potentially leading to the execution of malicious payloads.","title":"Microsoft Winget: Execution of local manifest installation","url":"https://feed.craftedsignal.io/briefs/2026-11-winget-local-manifest/"}],"language":"en","title":"CraftedSignal Threat Feed - System-Administration","version":"https://jsonfeed.org/version/1.1"}