Identifier / Programs / Windows
winget.exe
Windows Package Manager. tldr-pages
LOLBAS Execute, Download, AWL Bypass 4 Sigma rules name it 2 ATT&CK techniques 3 documented commands
How winget.exe is abused
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for winget.exe.
3 documented commands
Execute T1105 Ingress Tool Transfer Local Administrator - required to enable local manifest setting privileges
Downloads a file from the web address specified in .yml file and executes it on the system. Local manifest setting must be enabled in winget for it to work: winget settings --enable LocalManifestFiles
winget.exe install --manifest {PATH:.yml}Trips 1 Sigma rule: mediumInstall New Package Via Winget Local Manifest by Sreeman, Florian Roth (Nextron Systems), frack113
Download T1105 Ingress Tool Transfer User privileges
Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine. For example, use "Sysinternals Suite" or 9p7knl5rwt25 for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.
winget.exe install --accept-package-agreements -s msstore {name or ID}Trips no Sigma process-creation rule.
AWL Bypass T1105 Ingress Tool Transfer User privileges
Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine, and even if AppLocker is active on the machine. For example, use "Sysinternals Suite" or 9p7knl5rwt25 for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.
winget.exe install --accept-package-agreements -s msstore {name or ID}Trips no Sigma process-creation rule.
1 of the 3 commands the identifier reads trips a Sigma process-creation rule; 2 trip none. These commands and their descriptions are from LOLBAS’s entry for winget.exe, by Paul Sanders, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for winget.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real winget.exe?
C:\Users\user\AppData\Local\Microsoft\WindowsApps\From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Install a package (use --source when package is available from multiple sources)
winget [add packageIdentifyRemove a package (Note: remove can also be used instead of uninstall)
winget [rm packageIdentifyDisplay information about a package
winget show packageIdentifyNone of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.