Windows Winget adds HTTP package source
Alerts when winget is used to add a package source pointing to an http:// URL.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-17
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of winget.exe where the command line includes the actions to add a source and specifically uses an http:// URL. Adding an insecure download source can enable tampering or man-in-the-middle scenarios if packages are fetched over plaintext transport. Telemetry required includes Windows process creation events with command-line arguments and process image/original file name for winget.exe.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/package-manager/winget/source
- github.comhttps://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Winget adds HTTP package source
id: 6bc7a522-f89c-4ee2-9f8b-5042f96ad7e9
related:
- id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
type: similar
- id: c15a46a0-07d4-4c87-b4b6-89207835a83b
type: similar
- id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
type: derived
status: test
description: This rule flags process executions of winget.exe where the command line includes the actions to add a source and specifically uses an http:// URL. Adding an insecure download source can enable tampering or man-in-the-middle scenarios if packages are fetched over plaintext transport. Telemetry required includes Windows process creation events with command-line arguments and process image/original file name for winget.exe.
references:
- https://learn.microsoft.com/en-us/windows/package-manager/winget/source
- https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \winget.exe
- OriginalFileName: winget.exe
selection_cli:
CommandLine|contains|all:
- "source "
- "add "
- http://
condition: all of selection_*
falsepositives:
- False positives might occur if the users are unaware of such control checks
level: high
license: DRL-1.1