WinGet DSC YAML Payload Disguised as .jpg or .txt File Extension
Detects execution of winget.exe with configuration arguments pointing to external or potentially suspicious file extensions like .jpg or .txt. This behavior is indicative of an adversary attempting to execute arbitrary code or scripts masquerading as configuration files, leveraging the Windows Package Manager 'configure' functionality to bypass security controls or execute malicious payloads.
CQL
