Registry Run Key Persistence Set via WinGet DSC ConfigurationRemotingServer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects modifications to Windows Registry Run or RunOnce keys initiated by ConfigurationRemotingServer.exe. This activity is indicative of persistence mechanisms where an executable is registered to launch automatically upon user logon or system startup.