WinGet DSC Engine Abuse via winget configure to Execute Embedded PowerShell
Detects the abuse of the Windows Package Manager (winget) Desired State Configuration (DSC) engine, where winget configure processes spawn configuration remoting or package manager server binaries. This behavior often indicates the execution of embedded PowerShell scripts or remote configuration files via YAML-based DSC configurations, which can be leveraged for malicious code execution.
Microsoft Sentinel (KQL)
