Skip to content
Threat Feed
Subscribe
high advisory

Potential Suspicious Winget Package Installation

This detection identifies potential suspicious Winget package installations by monitoring for Zone.Identifier streams on files downloaded to the Winget temporary directory from specific sources.

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Sources
1 public source
Freshness
Revision 1Nov 10, 02:45 UTC
Detection
1 rule
Source quality
A2Roughly even chance

This detection identifies potential suspicious Winget package installations. It specifically monitors the creation of Zone.Identifier alternate data streams associated with files downloaded to the Winget temporary directory. The rule triggers when files are marked with a ZoneId of 3 and originate from specific URL patterns.

Reference

Detection coverage 1

Detect Potential Suspicious Winget Package Installation

high
sigma tactics: persistence, stealth sources: create_stream_hash, windows

Detection queries are available on the platform. Get full rules →