From a06c2a2af54244de46110a04df8c8ee9e5f12089 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 17 Aug 2024 22:53:02 +0000 Subject: [PATCH] Applying update LOLBAS-Project/LOLBAS@659a0240e857563ff7120177d0d60749c00627ec --- _lolbas/Binaries/Winget.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/_lolbas/Binaries/Winget.md b/_lolbas/Binaries/Winget.md index 727d0c1..deca599 100644 --- a/_lolbas/Binaries/Winget.md +++ b/_lolbas/Binaries/Winget.md @@ -5,12 +5,19 @@ Author: Paul Sanders Created: 2022-01-03 Commands: - Command: winget.exe install --manifest manifest.yml - Description: 'Downloads a file from the web address specified in manifest.yml and executes it on the system. Local manifest setting must be enabled in winget for it to work: "winget settings --enable LocalManifestFiles"' + Description: 'Downloads a file from the web address specified in manifest.yml and executes it on the system. Local manifest setting must be enabled in winget for it to work: `winget settings --enable LocalManifestFiles`' Usecase: Download and execute an arbitrary file from the internet Category: Execute Privileges: Local Administrator - required to enable local manifest setting MitreID: T1105 OperatingSystem: Windows 10, Windows 11 + - Command: winget.exe install --accept-package-agreements -s msstore [name or ID] + Description: 'Download and install any software from the Microsoft Store using its name or Store ID, even if the Microsoft Store App itself is blocked on the machine. For example, use "Sysinternals Suite" or `9p7knl5rwt25` for obtaining ProcDump, PsExec via the Sysinternals Suite. Note: a Microsoft account is required for this.' + Usecase: Download and install software from Microsoft Store, even if Microsoft Store App is blocked + Category: Download + Privileges: User + MitreID: T1105 + OperatingSystem: Windows 10, Windows 11 Full_Path: - Path: C:\Users\user\AppData\Local\Microsoft\WindowsApps\winget.exe Code_Sample: @@ -26,4 +33,5 @@ Resources: Acknowledgement: - Person: Paul Handle: '@saulpanders' + - Person: Konrad 'unrooted' Klawikowski ---