WinGet DSC Abuse - ConfigurationRemotingServer Spawned by winget configure

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the Windows Package Manager (winget.exe) spawning the ConfigurationRemotingServer.exe process. This behavior, observed when using the 'winget configure' command, may indicate the execution of embedded PowerShell DSC scripts that can be used to maliciously configure a machine.