WinGet DSC LoLBin - configure Command Executing Arbitrary Code via YAML

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects suspicious use of winget.exe and its associated COM API components (ConfigurationRemotingServer.exe and WindowsPackageManagerServer.exe). The rule monitors for unauthorized child process spawning (e.g., cmd.exe, powershell.exe) by the package manager, execution of manual configuration activation via COM, and use of winget to pull external YAML configurations or non-standard file types, which may indicate software supply chain compromise or abuse of system management tools for payload delivery.