Local Admin Account Creation via WinGet DSC PSDscResources (DSCourier)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects the execution of account management commands such as user creation or group member modification initiated by or originating from 'ConfigurationRemotingServer.exe'. It also monitors for subsequent Windows Security Event IDs 4720 (User Account Created) and 4732 (Member added to local group) specifically targeting the 'Administrators' group, which indicates potential unauthorized administrative account or group membership manipulation.