Service Creation via WinGet DSC ConfigurationRemotingServer.exe (DSCourier)
Detects the creation or configuration of Windows services spawned by WinGet-related processes such as ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is often associated with software installation or configuration management but could be abused by adversaries to establish persistence or execute code with elevated privileges.
Splunk (SPL)
