WinGet DSC Service Persistence - sc.exe Spawned by ConfigurationRemotingServer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where ConfigurationRemotingServer.exe spawns sc.exe, which is indicative of Windows service creation or modification occurring via WinGet Desired State Configuration (DSC) abuse to establish persistence.