WinGet DSC Service Installation as SYSTEM via ConfigurationRemotingServer
Detects the creation of new services or modification of service configurations using command-line tools (sc.exe, PowerShell) spawned by 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe'. This activity is indicative of potential privilege escalation or persistence mechanisms being established under the context of legitimate Windows components.
SentinelOne
