Operation DragonReturn MixedSvc Service Persistence via sc.exe Masquerading

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the use of the Windows Service Control Manager (sc.exe) to create, delete, or start a service named 'MixedSvc', or attempts to execute a process masquerading as 'Mixed Reality.exe' from a suspicious directory (Windows Media Player folder). These activities are often associated with persistence or masquerading techniques used by threat actors.