ConfigurationRemotingServer.exe Spawned by WinGet or WindowsPackageManagerServer for DSC Proxy Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects execution of ConfigurationRemotingServer.exe, which is commonly spawned by the Windows Package Manager (winget) or WindowsPackageManagerServer.exe. This activity is part of the Windows package management infrastructure and is identified here to track the usage of these binaries which can be abused to execute commands or manipulate packages.