WinGet DSC Configuration History Database Access or Creation Detected
This rule detects unauthorized access or modification attempts to the Microsoft WinGet DSC (Desired State Configuration) configuration history database and associated YAML configuration files. WinGet stores execution history and DSC configuration files in specific directories; unauthorized processes interacting with these files may indicate an attempt to gain persistence, escalate privileges, or conduct reconnaissance on configured system states by inspecting or tampering with deployment manifests.
Microsoft Sentinel (KQL)
