{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/winget/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["winget","living-off-the-land","execution"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eWinget is a command-line utility used to manage software installations on Windows. It is possible to add custom package sources for the tool to fetch software from. Security controls prevent the addition of sources via HTTP due to the risk of man-in-the-middle attacks, but the attempt to add such a source may indicate an attacker testing for misconfigurations or attempting to force a policy bypass.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect attempts to register insecure package repositories.\u003c/li\u003e\n\u003cli\u003eAudit existing Winget sources via the \u003ccode\u003ewinget source list\u003c/code\u003e command to ensure only authorized, HTTPS-enabled repositories are configured.\u003c/li\u003e\n\u003cli\u003eRestrict command-line execution permissions for standard users to prevent unauthorized modification of package management configurations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T03:08:00Z","date_published":"2026-11-10T03:08:00Z","id":"https://feed.craftedsignal.io/briefs/2026-11-winget-insecure-source/","summary":"An attacker may attempt to register an insecure HTTP source within the Windows Package Manager (Winget) to facilitate malicious package delivery.","title":"Winget: Addition of insecure download source","url":"https://feed.craftedsignal.io/briefs/2026-11-winget-insecure-source/"}],"language":"en","title":"CraftedSignal Threat Feed - Winget","version":"https://jsonfeed.org/version/1.1"}