Sigma Rule Library

Add Insecure Download Source To Winget

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

View on GitHubOpen raw file

Detection logic

selection_img

- Image|endswith: \winget.exe
- OriginalFileName: winget.exe

selection_cli

CommandLine|contains|all:
  - "source "
  - "add "
  - http://

Condition

all of selection_*

Raw YAML

title: Add Insecure Download Source To Winget
id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
related:
    - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
      type: similar
    - id: c15a46a0-07d4-4c87-b4b6-89207835a83b
      type: similar
status: test
description: |
    Detects usage of winget to add a new insecure (http) download source.
    Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
references:
    - https://learn.microsoft.com/en-us/windows/package-manager/winget/source
    - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-17
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\winget.exe'
        - OriginalFileName: 'winget.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'source '
            - 'add '
            - 'http://'
    condition: all of selection_*
falsepositives:
    - False positives might occur if the users are unaware of such control checks
level: high

False positives

  • False positives might occur if the users are unaware of such control checks

References

Related rules

Similar rules

Add New Download Source To Winget

medium

windows · Shares T1059

Add Potential Suspicious New Download Source To Winget

medium

windows · Shares T1059

Conhost Spawned By Uncommon Parent Process

medium

windows · Shares T1059

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

medium

windows · Shares T1059