System-Administration - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/system-administration/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 03:08:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMicrosoft Winget: Execution of local manifest installationhttps://feed.craftedsignal.io/briefs/2026-11-winget-local-manifest/Tue, 10 Nov 2026 03:08:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-winget-local-manifest/Adversaries may abuse the Windows Package Manager (winget) to install arbitrary applications by passing local manifest files, potentially leading to the execution of malicious payloads.The Windows Package Manager (winget) includes functionality to install applications using a local manifest file (YAML). This capability, while designed for administrative use and local testing, allows for the installation of software from local sources. Adversaries can leverage this feature to execute or install malicious files (such as .exe, .msi, or .msix) by providing a crafted manifest, effectively using winget as a LOLBin (Living-off-the-Land Binary) to facilitate the execution of arbitrary payloads.

Impact

The use of this technique can result in unauthorized application installation and potential code execution on a target endpoint, depending on the contents of the local manifest and the associated payload.

Recommendation

Deploy the provided Sigma rule to monitor process-creation events for suspicious command-line arguments involving winget. Environments that do not use local manifest installation for software deployment should treat any detection as a high-fidelity alert.

]]>mediumadvisorylolbinexecutionwindowssystem-administration