WinGet DSC Scheduled Task Persistence via ConfigurationRemotingServer
Detects instances where ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe are observed spawning schtasks.exe, powershell.exe, or pwsh.exe with command line arguments indicative of creating or registering a scheduled task. This behavior is highly irregular for these system binaries and may indicate an adversary attempting to achieve persistence by masquerading or exploiting legitimate Windows management components.
SentinelOne
