WinGet DSC Chain Spawning Shell or Making Outbound Network Connections

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•8

Detects suspicious behavior originating from Windows Package Manager (winget.exe) and associated DSC/Server processes. This rule identifies two specific patterns: 1) These processes spawning shells or interpreters (e.g., PowerShell, cmd, mshta) which may indicate command-line abuse or malicious script execution. 2) These processes making outbound network connections to non-private/external IP addresses, potentially indicating remote payload delivery or command and control activity.