WinGet DSC YAML Abuse - PowerShell Execution via ConfigurationRemotingServer
Detects the abuse of the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine, specifically via the 'ConfigurationRemotingServer.exe' process. Adversaries may leverage this mechanism to execute embedded PowerShell scripts with elevated privileges, bypassing standard execution contexts by abusing the legitimate package management infrastructure. The rule tracks the lifecycle of this abuse, from initial activation via 'winget.exe' or 'WindowsPackageManagerServer.exe' to the final execution of PowerShell or other shells by the configuration server.
SentinelOne
