WinGet.exe spawning cmd, PowerShell, or DSC child processes

Ibrahim Saud@tektrix

•updated 15 days ago•2•0•3

Detects instances where the Windows Package Manager (winget.exe) initiates potentially suspicious child processes such as command shells or administrative tools, and correlates this activity with network connections originating from those child processes.