WinGet Server Manual Activation via COM API Abuse

Ethan Andrews@eandrews

•updated Jun 9, 2026•3•0•10

Detects WindowsPackageManagerServer.exe launching with the '--manualActivation' flag. This behavior is indicative of the DSCourier COM API abuse technique, which bypasses the standard winget.exe binary to execute malicious Desired State Configuration (DSC) payloads stealthily.