Suspicious Service Creation and Rapid Execution

Ankit Mehta@Secvyn

•updated Jun 25, 2026•0•0•0

Detects the creation of a Windows service using administrative tools (sc.exe or net.exe) followed closely by an instruction to start that service within a 5-minute window. This behavior is often associated with the execution of malicious payloads or lateral movement.