Windows Service Created via WinGet DSC ConfigurationRemotingServer Child Process
Detects the creation of Windows services or modification of service configurations triggered by WinGet DSC-related processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe). This pattern is often associated with the DSCourier persistence technique, where adversaries leverage the Desired State Configuration (DSC) framework to maintain a presence on a compromised host.
Microsoft Sentinel (KQL)
