ConfigurationRemotingServer.exe Spawning PowerShell or Conhost (DSC Abuse)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the ConfigurationRemotingServer.exe process spawning PowerShell or related host processes (pwsh.exe, conhost.exe), which may indicate the abuse of remoting or management services to execute scripts or bypass security controls.