WinGet DSC Configure Loading Non-YAML Extension File (T1036.008)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the use of 'winget.exe' to initiate a configuration operation where the provided file path does not use the expected '.yaml' or '.yml' extension. This behavior suggests an attempt to bypass security controls or masquerade malicious content (e.g., as a text or image file) that is then processed by the WinGet DSC engine, potentially leading to unauthorized PowerShell execution.