WinGet DSC ConfigurationRemotingServer.exe Registry Run Key Persistence
Detects modifications to Windows Registry Run or RunOnce keys initiated by 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe'. These processes are associated with Windows Package Manager (WinGet) and Desired State Configuration (DSC). Adversaries may abuse the DSC Script resource or other WinGet mechanisms to gain persistence by injecting malicious entries into these registry keys.
Sigma
