medium
advisory
Winget: Detecting Addition of Suspicious Package Sources
Detection of potential usage of winget to add new potentially suspicious download sources via IP addresses.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 03:08 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
The Windows Package Manager (winget) can be used to add new package sources. This detection identifies the addition of sources via direct IP addresses, which may be potentially suspicious. This activity is monitored by tracking process creation events for winget.exe with specific command-line arguments.
Detection coverage 1
Detect Suspicious Winget Source Addition
mediumDetects the addition of a new winget source pointing to a direct IP address.
sigma
tactics: execution
techniques: T1059
sources: process_creation, windows
Detection queries are available on the platform. Get full rules →