winget.exe

The Windows Package Manager installs from a local manifest (--manifest) whose Installer URL points at an arbitrary file that is then downloaded and executed, or installs a Microsoft Store package by ID even when the Store app is blocked and AppLocker is active. Either path fetches and runs code through a signed installer, bypassing application-control policy.

Use Download-and-execute an arbitrary installer, or pull software from the Store, past AppLocker/Store restrictions.

winget.exe install --manifest C:\Windows\Temp\x.yml
winget.exe install --accept-package-agreements -s msstore {StoreID}

Context

user

Native

Execute, AWL Bypass

MITRE

T1105T1218

Detection

Detection: winget.exe install --manifest referencing a local/temp .yml; winget pulling installers from non-standard hosts; msstore installs where the Store app is policy-blocked; winget-spawned installer processes writing to unusual locations.

Verified

✓ LOLBAS Winget.yml quotes `winget.exe install --manifest {PATH:.yml}` (download+execute, T1105) and `winget.exe install --accept-package-agreements -s msstore {name/ID}` (AWL Bypass, installs even if Store app blocked); match.

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Winget.yml

learn.microsoft.com/en-us/windows/package-manager/winget/install