UI0Detect Service Query or Disablement Attempt

wakasa smoky@wakasadb3

•updated Apr 28, 2026•0•169

Detects attempts to query, stop, or disable the legacy UI0Detect (Interactive Services Detection) service using the 'sc.exe' utility. This behavior was observed in the Lotus Wiper destructive campaign to suppress interactive service warnings before wiping the system.