DSCourier Local Admin Account Creation via ConfigurationRemotingServer DSC

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of a local administrator account or modification of the Administrators group through ConfigurationRemotingServer.exe. This activity is associated with the DSCourier persistence technique, which leverages Windows PowerShell Desired State Configuration (DSC) to maintain unauthorized administrative access.