DSCourier WinGet DSC Service Installation via ConfigurationRemotingServer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of Windows services initiated by ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This behavior is indicative of the abuse of the Windows Package Manager (WinGet) DSC configuration engine to install persistent malicious services, potentially leveraging PSDscResources.