PUA: Encrypted file detections should not block legitimate packages

Created with GitHub Copilot assistance.

Relevant area(s)

WinGet CLI

Description of the new feature / enhancement

This is a sub-issue of #6189 for a specific class of PUA detection: encrypted files.

Some legitimate applications include encrypted components as part of their build process (e.g., auto-update clients, license enforcement modules). Detection engines like K7 flag these with generic "File is encrypted!" detections, which triggers ESRP scan blocking in the WinGet Community Repository.

Known examples:

• Trados Studio — IndigoRose TrueUpdate UpdateClient.dat is encrypted by design during the build process (PR #373424)
• Malwarebytes — K7 encrypted file detection (PR #356473)

Unlike detections for remote access or adware behaviors, an "encrypted file" detection does not indicate malicious intent — it simply means a file within the installer is not readable by the scanning engine. This is a common practice for protecting proprietary update mechanisms and licensing logic.

Proposed approach

Once the parent issue (#6189) design for PUA classes and Group Policy controls is in place, "encrypted file" detections should be one of the first classes considered for an allow-path, given:

1. The detection is purely structural (file is encrypted), not behavioral
2. The publishers are known and have a history of legitimate submissions
3. The encryption is an intentional part of their toolchain (IndigoRose TrueUpdate, etc.)

Related

• Parent: #6189
• #6107
• https://github.com/microsoft/winget-pkgs/pull/373424
• https://github.com/microsoft/winget-pkgs/pull/356473

Proposed technical implementation details

No response

Start with the WinGet CLI context and parent issue #6189, whose PUA classes and Group Policy design this sub-issue depends on. Review related issue #6107 and the referenced Trados Studio and Malwarebytes package pull requests for the detection cases. Done means the resulting design identifies how encrypted-file detections can receive an allow path without treating structural encryption as malicious behavior.