Malicious Windows Service Creation via sc.exe Suspicious BinPath

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the creation or modification of Windows services using sc.exe where the binary path (binpath) points to suspicious or user-writable directories such as User profiles, AppData, Temp, or Public folders, which are often used by adversaries for persistence or privilege escalation.