Add Insecure Download Source To Winget

Title: Add Insecure Download Source To Winget
Status: test
Description:Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
References:
  -https://learn.microsoft.com/en-us/windows/package-manager/winget/source
  -https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-17
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\winget.exe' OriginalFileName:'winget.exe'   selection_cli:
    CommandLine|contains|all:
      -'source '
      -'add '
      -'http://'

  condition:all of selection_*
Falsepositives:
  -False positives might occur if the users are unaware of such control checks
Level: high