Registry Run Key Persistence via WinGet DSC ConfigurationRemotingServer
Detects the creation or modification of Windows Registry Run/RunOnce keys by processes related to the WinGet DSC (Desired State Configuration) engine. This activity may indicate an adversary attempting to establish persistence by abusing legitimate configuration management utilities to execute malicious code at user logon.
Microsoft Sentinel (KQL)
