Suspicious WinGet Package Installation from Untrusted Source

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the creation of an Alternate Data Stream (ADS) named ':Zone.Identifier' within the WinGet temporary directory, specifically when the ZoneId is '3' (Internet) and the source URL contains suspicious IP address patterns (e.g., '://1', '://2', etc.). This indicates a file downloaded from the internet via WinGet that might originate from an untrusted or suspicious source, potentially used for defense evasion or persistence.