huntrule

Windows Winget adds HTTP package source

Alerts when winget is used to add a package source pointing to an http:// URL.

FreeUnreviewedSigmahighv1
title: Windows Winget adds HTTP package source
id: 6bc7a522-f89c-4ee2-9f8b-5042f96ad7e9
related:
  - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
    type: similar
  - id: c15a46a0-07d4-4c87-b4b6-89207835a83b
    type: similar
  - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
    type: derived
status: test
description: This rule flags process executions of winget.exe where the command line includes the actions to add a source and specifically uses an http:// URL. Adding an insecure download source can enable tampering or man-in-the-middle scenarios if packages are fetched over plaintext transport. Telemetry required includes Windows process creation events with command-line arguments and process image/original file name for winget.exe.
references:
  - https://learn.microsoft.com/en-us/windows/package-manager/winget/source
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \winget.exe
    - OriginalFileName: winget.exe
  selection_cli:
    CommandLine|contains|all:
      - "source "
      - "add "
      - http://
  condition: all of selection_*
falsepositives:
  - False positives might occur if the users are unaware of such control checks
level: high
license: DRL-1.1

What it detects

This rule flags process executions of winget.exe where the command line includes the actions to add a source and specifically uses an http:// URL. Adding an insecure download source can enable tampering or man-in-the-middle scenarios if packages are fetched over plaintext transport. Telemetry required includes Windows process creation events with command-line arguments and process image/original file name for winget.exe.

Known false positives

  • False positives might occur if the users are unaware of such control checks

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.