DragonReturn MixedSvc Persistence via sc.exe Masquerading as Windows Mixed Reality
Detects the use of the Windows Service Control Manager (sc.exe) to create, start, or delete a service named 'MixedSvc'. The rule includes specific checks for binPath configurations, which can be indicative of persistence or privilege escalation attempts using services.
Splunk (SPL)
