Local user creation persisted via WinGet DSC configuration apply

Ibrahim Saud@tektrix

•updated 15 days ago•0•0•3

This rule detects the suspicious creation or modification of local user accounts (e.g., 'svc_ipurple') occurring within a short 15-minute window following the execution of Windows Package Manager (Winget) configuration tasks. This behavior may indicate an attacker using automated configuration files (DSC) to establish persistence or escalate privileges on a compromised system.