WinGet DSC configure used to execute embedded PowerShell via YAML file
Detects potentially malicious use of the Windows Package Manager (WinGet) to configure system environments, specifically targeting flags that bypass user interactivity or agreements, as well as the spawning of the ConfigurationRemotingServer by WinGet or related package management processes, which could indicate the deployment of unauthorized or malicious configurations.
Splunk (SPL)
