Add Potential Suspicious New Download Source To Winget

Title: Add Potential Suspicious New Download Source To Winget
Status: test
Description:Detects usage of winget to add new potentially suspicious download sources
References:
  -https://learn.microsoft.com/en-us/windows/package-manager/winget/source
  -https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-17
modified:2023-12-04
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\winget.exe' OriginalFileName:'winget.exe'   selection_cli:
    CommandLine|contains|all:
      -'source '
      -'add '

  selection_source_direct_ip:
    CommandLine|re: '://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium