Tool

github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget

https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget

Published on: github.com

ATT&CK techniques those detections carry

T1059Command and Scripting Interpreter

7 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Enable Local Manifest Installation With Winget	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Winget Admin Settings Modification	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Install New Package Via Winget Local Manifest	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Add Potential Suspicious New Download Source To Winget	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Add Insecure Download Source To Winget	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Add New Download Source To Winget	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential Suspicious Winget Package Installation	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 7 of 7

Filter in the catalogue