Service Creation via sc.exe and cmd.exe

Ankit Mehta@Secvyn

•updated Jun 5, 2026•8•0•6

Detects the creation or configuration of a Windows service using 'sc.exe' executed via 'cmd.exe', specifically looking for commands containing 'create' or 'config' along with 'binpath'. This activity can indicate persistence mechanisms or privilege escalation attempts by adversaries.