WinGet COM API Abuse - DSCourier-style DSC Execution Without winget.exe Parent
Detects suspicious process execution patterns related to WindowsPackageManagerServer.exe and ConfigurationRemotingServer.exe, which can be abused for command execution or bypassing standard interaction via COM interfaces. This includes spawning the package manager server from unauthorized parent processes, the use of manual activation flags for COM abuse, and the spawning of shell or utility processes from the configuration remoting server.
Cortex XDR
