Add Insecure Download Source To Winget

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects attempts to add an insecure (HTTP) download source to Winget. While Winget is designed to prevent the addition of insecure sources, this activity could indicate an attempt to bypass security controls or a user error. This rule specifically looks for the execution of 'winget.exe' with 'source add' and 'http://' in the command line.