DSCourier COM API WinGet DSC Execution Without winget.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

This rule detects abnormal process execution chains involving DSCourier.exe invoking the Windows Package Manager (WinGet) DSC engine components (WindowsPackageManagerServer.exe and ConfigurationRemotingServer.exe) via COM API, bypassing the standard winget.exe parent process. This behavior is indicative of potential process hollowing, evasion, or malicious use of built-in system management tools.