DSCourier Reverse Shell via WinGet DSC Abuse (ConfigurationRemotingServer.exe)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects the execution of ConfigurationRemotingServer.exe, which is the backend process used by the Windows Package Manager (winget) when applying configuration files. The detection specifically monitors for this process being spawned by winget.exe with flags indicating the acceptance of configuration agreements and the execution of a configuration command.