Operation DragonReturn DcRAT MixedSvc Service Creation via sc.exe

Ethan Andrews@eandrews

•updated Jun 26, 2026•1•0•3

Detects the creation of the 'MixedSvc' Windows service, which is used by DcRAT malware in Operation DragonReturn for persistence. The malware masquerades as 'Windows Mixed Reality Service' and sets the service's binPath to 'C:\Program Files\Windows Media Player\Mixed Reality.exe'.