Service StartupType Change Via Sc.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the use of the 'sc.exe' utility to change the startup type of a Windows service to 'disabled' or 'demand'. This action can be used by adversaries to impair defenses or prevent legitimate services from starting.