Skip to content
Threat Feed
Subscribe
high advisory

Winget: Addition of insecure download source

An attacker may attempt to register an insecure HTTP source within the Windows Package Manager (Winget) to facilitate malicious package delivery.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
High
Action
Monitor or close
Sources
2 public sources
Freshness
Revision 1Nov 10, 03:08 UTC
Detection
1 rule
Source quality
A2Roughly even chance

Winget is a command-line utility used to manage software installations on Windows. It is possible to add custom package sources for the tool to fetch software from. Security controls prevent the addition of sources via HTTP due to the risk of man-in-the-middle attacks, but the attempt to add such a source may indicate an attacker testing for misconfigurations or attempting to force a policy bypass.

Recommendation

  • Deploy the provided Sigma rule to detect attempts to register insecure package repositories.
  • Audit existing Winget sources via the winget source list command to ensure only authorized, HTTPS-enabled repositories are configured.
  • Restrict command-line execution permissions for standard users to prevent unauthorized modification of package management configurations.

Immediate actions

Deploy Sigma rule to flag insecure configuration attempts.

Detection Engineering 48h

Threat Hunt

Identify hosts where custom Winget sources are currently configured.

T1059 medium medium confidence hunt now

Data: Output of "winget source list" from endpoint management systems

Detection coverage 1

Detect Addition of Insecure Winget Source

high

Detects the usage of winget to add a package source via insecure HTTP.

sigma tactics: execution techniques: T1059 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →