Scheduled Task Creation via WinGet DSC ConfigurationRemotingServer (DSCourier)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•7

Detects persistence establishment via the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine. The rule identifies instances where 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe' spawns 'schtasks.exe' or uses PowerShell to create scheduled tasks. It correlates process execution events with Security Event ID 4698 to identify unauthorized scheduled task creation within the WinGet DSC context.