Windows: winget.exe adds new download sources via 'source add'
Alerts on winget.exe usage to add new package download sources using 'source add'.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-17
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where winget.exe is executed with command-line arguments containing both 'source ' and 'add ', indicating an attempt to register a new package download source. Attackers may use this to redirect package retrieval to attacker-controlled repositories or introduce untrusted sources. Telemetry relies on Windows process creation events including the executable name or original filename and the full command line.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/package-manager/winget/source
- github.comhttps://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_custom_source.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: winget.exe adds new download sources via 'source add'"
id: e388cef3-9359-4a03-927b-6b181639548f
related:
- id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
type: similar
- id: c15a46a0-07d4-4c87-b4b6-89207835a83b
type: similar
- id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
type: derived
status: test
description: This rule flags process creation where winget.exe is executed with command-line arguments containing both 'source ' and 'add ', indicating an attempt to register a new package download source. Attackers may use this to redirect package retrieval to attacker-controlled repositories or introduce untrusted sources. Telemetry relies on Windows process creation events including the executable name or original filename and the full command line.
references:
- https://learn.microsoft.com/en-us/windows/package-manager/winget/source
- https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_custom_source.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-17
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \winget.exe
- OriginalFileName: winget.exe
selection_cli:
CommandLine|contains|all:
- "source "
- "add "
condition: all of selection_*
falsepositives:
- False positive are expected with legitimate sources
level: medium
license: DRL-1.1