WinGet Silent Configuration Execution
Detects the command-line usage of WinGet invoking a configuration file, specifically targeting switches designed for silent, non-interactive execution. Threat actors abuse this capability to execute arbitrary code via YAML files.
Microsoft Sentinel (KQL)
