WinGet DSC Registry Run-Key Persistence via ConfigurationRemotingServer
Detects potential persistence mechanism where the WinGet Desired State Configuration (DSC) process 'ConfigurationRemotingServer.exe' writes to the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' registry key. This is a suspicious behavior indicative of abuse, as legitimate DSC operations should not typically modify user-level persistence keys in this manner.
YARA-L
