DcRAT MixedSvc Persistence via sc.exe with Windows Media Player binPath

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•6

Detects the creation or modification of a Windows service named 'MixedSvc' or containing 'Mixed Reality' in the command line where the binPath points to a non-System32 directory or the Windows Media Player folder, which is indicative of potential service hijacking or persistence techniques.