Remote Service Creation via sc.exe UNC Path – Lateral Movement

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•3

Detects the execution of sc.exe with subcommands 'create' or 'start' where the command line includes a UNC path. This pattern is indicative of an adversary attempting to install or execute a service on a remote host to facilitate lateral movement.