Service Crash Followed by SCM Execution

Ethan Andrews@eandrews

•updated Feb 27, 2026•1•0•37

Detects a sequence where a service terminates unexpectedly, followed immediately by a process creation from the Service Control Manager (services.exe). This pattern can indicate that a service's recovery options have been configured to run a malicious program upon failure.