WinGet DSC Abuse - winget configure Spawning ConfigurationRemotingServer
Detects execution of ConfigurationRemotingServer.exe as a child process of winget.exe. This activity is indicative of the DSCourier technique, which abuses the Windows Package Manager Desired State Configuration (DSC) engine to execute arbitrary PowerShell scripts embedded in configuration files, bypassing standard PowerShell invocation monitoring.
Sigma
