[Diablo-research]

Adds a command entry for winget configure, which applies a WinGet Configuration (DSC) file.

A PowerShell DSC Script resource in the file executes its SetScript as a child of the signed Microsoft binary ConfigurationRemotingServer.exe, not powershell.exe. This is the proxy-execution property: unsigned script code runs under a signed Microsoft process tree.

Verified on Windows 11, WinGet v1.29.380, Sysmon 15.22:

• Ran as a standard user (non-elevated, no UAC prompt), exit 0 — hence Privileges: User.
• Process tree captured: winget.exe -> ConfigurationRemotingServer.exe -> notepad.exe
  (a benign Start-Process notepad.exe payload in a Script resource).

The technique is publicly documented (Compass Security 2026, ipurple.team 2026); this entry
catalogues it for LOLBAS. Category Execute, MitreID T1218.