Windows: winget.exe adds new download sources via 'source add'

Alerts on winget.exe usage to add new package download sources using 'source add'.

FreeUnreviewedSigmamediumv1

windows-winget-exe-adds-new-download-sources-via-source-add-05ebafc8

title: "Windows: winget.exe adds new download sources via 'source add'"
id: e388cef3-9359-4a03-927b-6b181639548f
related:
  - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
    type: similar
  - id: c15a46a0-07d4-4c87-b4b6-89207835a83b
    type: similar
  - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
    type: derived
status: test
description: This rule flags process creation where winget.exe is executed with command-line arguments containing both 'source ' and 'add ', indicating an attempt to register a new package download source. Attackers may use this to redirect package retrieval to attacker-controlled repositories or introduce untrusted sources. Telemetry relies on Windows process creation events including the executable name or original filename and the full command line.
references:
  - https://learn.microsoft.com/en-us/windows/package-manager/winget/source
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_custom_source.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \winget.exe
    - OriginalFileName: winget.exe
  selection_cli:
    CommandLine|contains|all:
      - "source "
      - "add "
  condition: all of selection_*
falsepositives:
  - False positive are expected with legitimate sources
level: medium
license: DRL-1.1

What it detects

This rule flags process creation where winget.exe is executed with command-line arguments containing both 'source ' and 'add ', indicating an attempt to register a new package download source. Attackers may use this to redirect package retrieval to attacker-controlled repositories or introduce untrusted sources. Telemetry relies on Windows process creation events including the executable name or original filename and the full command line.

Known false positives

False positive are expected with legitimate sources

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.