WinGet ConfigurationRemotingServer Process Creation

Ethan Andrews@eandrews

•updated Jun 9, 2026•2•0•6

Detects process creation where ConfigurationRemotingServer.exe is spawned by winget.exe or WindowsPackageManagerServer.exe. This activity indicates potential WinGet DSC (Desired State Configuration) execution or COM API abuse. Adversaries may leverage WinGet to execute malicious configurations or scripts.