WinGet DSC ConfigurationRemotingServer spawning local admin account creation
Detects the use of Windows Package Manager utilities (winget.exe, WindowsPackageManagerServer.exe) or ConfigurationRemotingServer.exe to execute administrative commands related to local user and group management, such as adding users or modifying group memberships. This behavior is highly irregular for these binaries and suggests potential abuse for persistence or privilege escalation.
SentinelOne
