SMB Lateral Movement PsExec-style SVCCTL Named Pipe OpenSCManager CreateService RPC

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects SMB traffic indicative of remote service creation over the SVCCTL named pipe, a pattern characteristic of tools like PsExec used for lateral movement and remote code execution.