WinGet DSC New-LocalUser Account Creation via ConfigurationRemotingServer
Detects the use of Windows Package Manager (winget) or Configuration Remoting Server processes to execute account management commands such as adding users or modifying group memberships via net.exe or PowerShell. This behavior is indicative of privilege escalation or persistence attempts using legitimate administrative tools.
Cortex XDR
