sc.exe Remote Service Creation via UNC Path (T1543.003)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the use of the sc.exe utility to create a new service on a remote system by specifying a path using a UNC share. This behavior is indicative of lateral movement, where an attacker attempts to execute code on a remote host by installing a service via SMB/Admin Shares.