Winget - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/winget/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 03:08:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWinget: Addition of insecure download sourcehttps://feed.craftedsignal.io/briefs/2026-11-winget-insecure-source/Tue, 10 Nov 2026 03:08:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-winget-insecure-source/An attacker may attempt to register an insecure HTTP source within the Windows Package Manager (Winget) to facilitate malicious package delivery.Winget is a command-line utility used to manage software installations on Windows. It is possible to add custom package sources for the tool to fetch software from. Security controls prevent the addition of sources via HTTP due to the risk of man-in-the-middle attacks, but the attempt to add such a source may indicate an attacker testing for misconfigurations or attempting to force a policy bypass.

Recommendation

  • Deploy the provided Sigma rule to detect attempts to register insecure package repositories.
  • Audit existing Winget sources via the winget source list command to ensure only authorized, HTTPS-enabled repositories are configured.
  • Restrict command-line execution permissions for standard users to prevent unauthorized modification of package management configurations.
]]>highadvisorywingetliving-off-the-landexecution