Remote Service Creation via SVCCTL RPC

Lacey Cochrane@NullVectorX

•updated 29 days ago•2•0•7

Detects remote service manipulation, including service creation, starting, and deletion, using the SVCCTL RPC interface. This activity is a common method for lateral movement and remote code execution by tools like PsExec, smbexec, and CrackMapExec.