Enable Local Manifest Installation With Winget
This rule detects when the 'EnableLocalManifestFiles' setting for AppInstaller (winget) is activated in the Windows Registry. Enabling this setting allows users to install new packages using custom manifests, which could be abused by adversaries to install malicious software or achieve persistence.
Sigma
