WinGet DSC Indirect PowerShell Execution via ConfigurationRemotingServer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects instances where Windows Package Manager (winget.exe) or its associated host processes (ConfigurationRemotingServer.exe, WindowsPackageManagerServer.exe) spawn PowerShell. This behavior is monitored for suspicious indicators such as the use of Desired State Configuration (DSC) modules or specific command-line flags (EncodedCommand, NonInteractive, NoProfile) which may indicate malicious activity attempting to masquerade as legitimate package management operations.