ConfigurationRemotingServer.exe spawned by WinGet or WindowsPackageManagerServer for DSC abuse
This rule detects the execution of ConfigurationRemotingServer.exe when spawned by unexpected parent processes, such as winget.exe, WindowsPackageManagerServer.exe, or DSCourier.exe. These processes are associated with Desired State Configuration (DSC) and package management, and their use to launch ConfigurationRemotingServer.exe in certain contexts may indicate exploitation of DSC features to execute unauthorized configurations or commands.
Splunk (SPL)
