UI0Detect Service Disablement Attempt

Tim Peck@timpeck

•updated Apr 22, 2026•4•0•356

Detects attempts to query, stop, or disable the legacy Interactive Services Detection (UI0Detect) service using the 'sc.exe' utility. This technique was observed in the Lotus Wiper destructive campaign to suppress interactive service graphical warnings before executing its wiper payload.