winget.exe

Downloads a file from the web address specified in .yml file and executes it on the system. Local manifest setting must be enabled in winget for it to work: `winget settings --enable LocalManifestFiles`

Use Download and execute an arbitrary file from the internet

winget.exe install --manifest {PATH:.yml}

Context

admin

Native

Execute

MITRE

T1105

Detection

IOC: winget.exe spawned with local manifest file

IOC: Sysmon Event ID 1 - Process Creation

Analysis: saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml

Refs

saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html

docs.microsoft.com/en-us/windows/package-manager/winget/#production-recommended

www.youtube.com/watch?v=zuL7x4Wltto

lolbas-project.github.io/lolbas/Binaries/winget/

Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine. For example, use "Sysinternals Suite" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.

Use Download and install software from Microsoft Store, even if Microsoft Store App is blocked

winget.exe install --accept-package-agreements -s msstore {name or ID}

Context

user

Native

Download

MITRE

T1105

Detection

IOC: winget.exe spawned with local manifest file

IOC: Sysmon Event ID 1 - Process Creation

Analysis: saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml

Refs

saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html

docs.microsoft.com/en-us/windows/package-manager/winget/#production-recommended

www.youtube.com/watch?v=zuL7x4Wltto

lolbas-project.github.io/lolbas/Binaries/winget/

Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine, and even if AppLocker is active on the machine. For example, use "Sysinternals Suite" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.

Use Download and install software from Microsoft Store, even if Microsoft Store App is blocked, and AppLocker is activated on the machine

winget.exe install --accept-package-agreements -s msstore {name or ID}

Context

user

Native

AWL Bypass

MITRE

T1105

Detection

IOC: winget.exe spawned with local manifest file

IOC: Sysmon Event ID 1 - Process Creation

Analysis: saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml

Refs

saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html

docs.microsoft.com/en-us/windows/package-manager/winget/#production-recommended

www.youtube.com/watch?v=zuL7x4Wltto

lolbas-project.github.io/lolbas/Binaries/winget/