WinGet DSC COM API Abuse - ConfigurationRemotingServer Without winget.exe Parent
Detects the execution of ConfigurationRemotingServer.exe by WindowsPackageManagerServer.exe when the parent process is not winget.exe. This pattern is indicative of unauthorized attempts to invoke the Windows Package Manager DSC (Desired State Configuration) engine directly, bypassing standard tooling and potentially indicating an attempt to leverage COM interface abuse for code execution.
YARA-L
