medium
advisory
Winget: Addition of custom package sources
This brief identifies the capability to monitor the Windows Package Manager (winget) for the addition of new download sources.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 04:38 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
The Windows Package Manager (winget.exe) supports the addition of new download sources via command-line arguments. This functionality can be monitored to track the registration of new package repositories.
Detection
Monitoring should focus on process creation events for winget.exe where the command line contains arguments for adding a new source. Legitimate administrative use of this command may result in false positives.
Detection coverage 1
Detect Addition of New Winget Source
mediumDetects usage of winget to add new additional download sources.
sigma
tactics: execution
techniques: T1059
sources: process_creation, windows
Detection queries are available on the platform. Get full rules →