Remote Service Creation or Start via sc.exe (Lateral Movement)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

This rule detects the use of the Windows Service Control Manager (sc.exe) to create or start a service on a remote host, identified by the presence of UNC paths (\\) and service management commands (create, start) in the command line.