WinGet can report on PUA coming from the "winget" source

Relevant area(s)

WinGet CLI

Description of the new feature / enhancement

A few software packages get flagged by various detection engines as PUA (Potentially Unwanted Application). In some cases, these packages are well known and when used responsibly pose no additional unknown risks to the user.

The first detection we encountered was RustDesk. The ESET detection engine reports a detection related to "RemoteAdmin".

• https://github.com/microsoft/winget-pkgs/pull/345601#issuecomment-4114118051

The second was Malwarebytes. The K7 detection engine is reporting that a file is encrypted.

• https://github.com/microsoft/winget-pkgs/pull/356473#issuecomment-4202429380

There will likely be other classes of PUA for software. This "parent" issue is intended to represent work in the WinGet Client to be able to block PUA by Group Policy, and if it's not blocked by Group Policy, the user can be informed.

Once we have a design for this, we can explore ways to modify our policies to allow specific classes of PUA into the WinGet Community Repository.

Related to:

• #5940

Proposed technical implementation details

No response

Start with the WinGet CLI area and review related issue #5940 plus the RustDesk and Malwarebytes detection examples linked in this issue. Define how PUA from the "winget" source should be identified, how Group Policy can block it, and how users are informed when it is not blocked; completion requires an agreed design before implementation work begins.