public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-06-20 18:45:12 +02:00
Code Issues Projects Releases Wiki Activity

Update Winget.yml (#436)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
Fred Cyber Security 2025-06-01 14:15:55 +02:00 committed by GitHub
parent d6e3d7016d
commit ea4d2a87b0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
yml/OSBinaries/Winget.yml
View File

@ -21,6 +21,13 @@ Commands:
Privileges: User
MitreID: T1105
OperatingSystem: Windows 10, Windows 11
- Command: winget.exe install --accept-package-agreements -s msstore {name or ID}
Description: 'Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine, and even if AppLocker is active on the machine. For example, use "Sysinternals Suite" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.'
Usecase: Download and install software from Microsoft Store, even if Microsoft Store App is blocked, and AppLocker is activated on the machine
Category: AWL Bypass
Privileges: User
MitreID: T1105
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: C:\Users\user\AppData\Local\Microsoft\WindowsApps\winget.exe
Code_Sample:
@ -33,7 +40,9 @@ Detection:
Resources:
- Link: https://saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html
- Link: https://docs.microsoft.com/en-us/windows/package-manager/winget/#production-recommended
- Link: https://www.youtube.com/watch?v=zuL7x4Wltto
Acknowledgement:
- Person: Paul
Handle: '@saulpanders'
- Person: Konrad 'unrooted' Klawikowski
- Person: Fredrik H. Brathen