Remote Service Creation (Lateral Movement)

Ankit Mehta@Secvyn

•updated Jun 10, 2026•3•0•12

Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.