Service Security Descriptor Tampering Via Sc.EXE

SigmaHQ Detections@sigmaHQ

•updated Sep 1, 2026•0•0•2

Detection of sc.exe utility adding a new service with special permission which hides that service.