Remote Service Creation via sc.exe Targeting Remote Host

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•1

Detects the creation or starting of a Windows service on a remote host using the Service Control Manager (sc.exe) utility. This is a common method for lateral movement and remote execution of malicious payloads.