Add Potential Suspicious New Download Source To Winget

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•13

This rule detects the usage of the Windows Package Manager (winget.exe) to add new package sources, specifically looking for command-line arguments that include 'source add' and an IP address as the source. This could indicate an attempt to introduce a malicious or untrusted package repository.