WinGet DSC Registry Run Key Persistence via ConfigurationRemotingServer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects modifications to Windows Registry Run keys that are initiated by processes related to the Windows Package Manager (winget), specifically ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe, or by PowerShell scripts spawned by these processes. This behavior may indicate an attempt to establish persistence.