Registry Run Key Persistence via DSC Engine (ConfigurationRemotingServer.exe)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation or modification of Windows Registry Run keys, which are common persistence mechanisms, by processes related to Desired State Configuration (DSC) (e.g., ConfigurationRemotingServer) or the Windows Package Manager (winget, WindowsPackageManagerServer). This rule flags entries in HKLM or HKCU Run keys created by these specific administrative or provisioning processes.