DSC WinGet Persistent Scheduled Task via ConfigurationRemotingServer.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is indicative of persistent scheduled task creation being orchestrated through the abuse of WinGet Desired State Configuration (DSC) resource management capabilities.