DSCourier WinGet DSC Abuse - Scheduled Task Created via ConfigurationRemotingServer
Detects instances where the ConfigurationRemotingServer.exe process spawns tools like schtasks.exe, powershell.exe, or pwsh.exe to create a scheduled task. This behavior is indicative of an attacker abusing the WinGet configuration management (DSC) engine, specifically via the 'winget configure' mechanism, to establish persistence by triggering the creation of a new scheduled task through a DSC script resource.
Sigma
