Detection proposal: WinGet Configuration (winget configure) abuse

Open
  • Is something wrong?
#4,383 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Domain
security

Research direction

The proposal adds two detections over the Endpoint.Processes data model: an Anomaly on ConfigurationRemotingServer.exe launched by winget.exe or WindowsPackageManagerServer.exe, and a TTP for winget configure pointed at an http(s) URL. Look at existing Windows process detections in security_content for the YAML layout, then check that the proposed searches match the 8 described test runs. Done means both detections pass contentctl-ng build and the maintainer has confirmed the fit before the anonymized dataset goes to attack_data.

Written by the indexing model from the issue text.

Description

enhancement

Is your feature request related to a problem? Please describe.
winget configure applies WinGet Configuration (DSC) files from a local path or an https URL. PowerShell DSC resources in the file run inside ConfigurationRemotingServer.exe instead of powershell.exe, so script-based detections don't see them. Public research describes this as an execution and initial-access technique (Zerosalarium 2024, Compass Security 2026, ipurple.team 2026). Yet security_content has no WinGet configuration analytics; Sigma and Elastic have none either, and LOLBAS does not list it.

Describe the solution you'd like
Two experimental analytics on Endpoint.Processes:

  • Windows WinGet Configuration Remoting Server Execution (Anomaly): ConfigurationRemotingServer.exe launched by winget.exe or WindowsPackageManagerServer.exe. Keying on the process launch makes it independent of the configure/configuration/dsc aliases, positional file arguments, file extensions and the WinGet COM API. A configuration_action field labels preview (show/validate/list/test) versus apply.
  • Windows WinGet Configuration File From Remote URL (TTP): winget configure (or its aliases) pointed at an http(s) URL, with or without -f/--file.

Describe alternatives you've considered

  • Excluding preview subcommands: rejected, because show and validate also start ConfigurationRemotingServer.exe; the field labels them instead.
  • A network rule on ConfigurationRemotingServer.exe: rejected, because it made an outbound HTTPS connection during a benign configure validate in my lab.

Additional context
Validated on native Windows 11, WinGet v1.29.380, Sysmon 15.22, using a read-only Microsoft.Windows.Developer/OsVersion assertion. The test data covers 8 runs: local, .txt-renamed and remote (GitHub gist) files, preview subcommands, and --version/list negative controls. Results: 6/6 and 1/1 expected, 0 hits on the negatives. contentctl-ng build passes on develop. Proposed story: Living Off The Land (T1218, T1059.001, T1105). No new WinGet vulnerability is claimed.

Related: #4382 (separate PKCS#11 proposal).

Would these fit as new analytics? If so, I'll open the PR and publish the anonymized dataset to attack_data.

Dominant language
Python
Stars
1.7k
Forks
507
Avg merge
2d 17h
Merged PRs (30d)
35

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/security_content

All issues in splunk/security_content

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.